Trust is a variable, not a constant.
That sentence has guided my life since 2017, when I reverse-engineered the GlobalToken smart contract and found a reentrancy bug that would have drained every investor who trusted a whitepaper promising 1,000% APY. I published the raw assembly code online. The whitepaper died. The pattern stuck.
So when I watched Fei-Fei Li on Bloomberg Technology, and I heard her say that advanced AI systems need oversight from independent institutions and the public sector, I didn't hear a bold statement. I heard an admission. An admission that internal self-assessment is a legal fiction. That the people who build the system cannot also certify the system. That the current paradigm is a confidence game.
She said it directly: "Internal researchers can measure individual model capabilities and safety properties, but this cannot replace broader standards established collaboratively by government, industry, and academic institutions."
That is not an AI governance talking point. That is a forensic audit finding.
The chain remembers what the ledger forgets. AI companies are producing ledgers of model cards, red-team reports, safety scores, and alignment benchmarks. They are all unaudited. They are all unauditable. And everyone with any experience in cryptographic security knows exactly where this story ends.
This is not a technology problem. This is an accountability gap. And if you think blockchain—my industry, the place I spend my professional life—has the answer, you are suffering from the same delusion as a VCs who believes a DAO can replace legal recourse.
Let me show you why.
The Self-Audit Fallacy
Every AI lab today operates on the same logic as a blockchain project that hires a smart contract auditor, publishes a stamped PDF, and calls it secured. The logic is: "We tested our own system. We hired people to test our system. Therefore the system is safe."
It is not safe. It was never safe. The report was never a measure of safety; it was a measure of intent.
Audits verify intent, not outcome. That is a lesson I have learned over and over. In 2020, when Bancor v2 suffered its liquidity drain, I spent a week analyzing the bonding curve logic. Everyone blamed the oracle latency. But the true root cause was not the price feed. It was the assumption that the oracle's deviation threshold would protect against a flash loan. It didn't. The code allowed a synchronous arbitrage that the threshold never detected.
The internal researchers at Bancor probably measured the model—I mean the protocol—in good faith. They tested price manipulation scenarios. They wrote tests. They shipped. And then the exploit happened anyway because internal testing inherently suffers from a blind spot: you cannot measure what you cannot imagine, and you cannot imagine what you don't want to see.
AI labs are no different. A safety team at OpenAI or Anthropic can measure the model's propensity to produce harmful text in a controlled setting. They can run red-team prompts. They can create robust benchmarks. But they cannot measure what the next user will prompt. They cannot measure emergent behavior at scale. They cannot predict the interaction of a model with a multi-agent system. They are standing in the same position as Bancor's developers in 2020: assuming the environment is static, when it is not.
I read AI model cards like I read crypto audit reports. I look at the methodology. I check the scope. I check the dataset. I check the model weight access. And in 90% of cases, I find the same gap: the evaluator had access to the training data. They knew the test prompts. That's benchmark contamination, and it is endemic.
Fei-Fei Li is not just advocating for more oversight. She is explicitly rejecting the idea that internal measurement is sufficient. She is saying the confidence interval from self-assessment is too wide to be trusted. That is the same conclusion I reached in 2022 when I audited FTX's reserve proofs. Their internal SQL databases were beautifully organized. Their on-chain wallets showed matching balances. Yet $400 million was missing, parked inside complex DeFi yield positions that the internal team had marked as "highly liquid." They believed their own spreadsheets.
The internal researchers who measured FTX's safety did not lie. They just failed. They failed because they had incentives to see the system as safe. That is the core problem. Incentives determine perspective. And no amount of internal talent can compensate for a structural misalignment.
Crypto Already Lived This Movie
In 2017, the ICO market was the perfect duplicate of the current AI safety vacuum. Projects published whitepapers. They presented their own technical teams. They had "advisors." They raised millions. The public was asked to trust the integrity of the team.
When I dissected GlobalToken, I didn't just find a bug. I found a pattern of deliberate obfuscation. The withdrawal function called the transfer function before incrementing the balance. That is a textbook reentrancy vector. But more importantly, the code comments in the contract had been removed to make the logic harder to follow. That was not an accident.
I published my findings. The project collapsed. And what did the industry learn? Almost nothing.
Flash loans expose the geometry of greed. I wrote that sentence in 2020, and I still believe it. The blockchain industry's response to trust deficits has always been to create more complex mechanisms: audit firms, insurance funds, decentralized autonomous organizations, zero-knowledge proofs, formal verification. Each of these is useful. Each of these is insufficient. Each of these creates a new intermediary that eventually becomes the single point of failure.
We call them "trustless" systems. But they are nothing of the sort. They are a chain of trust, with every link centralized. The bug was there before the deployment. Always.
Now the AI world is trying to solve the same problem from the same place. Fei-Fei Li says we need independent institutions and public sector oversight. Good. But who will oversee the overseers? In crypto, we hire independent auditors to check our code. But those auditors are paid by the projects they audit. That is a conflict of interest. The same project that wants a favorable report controls the funding. The auditor who gives a failing grade gets no future contracts.
The situation with AI safety is identical. Who funds the independent evaluation? If it is an academic institution receiving grants from AI companies, it's not independent. If it is a regulatory agency staffed by people who have never touched a transformer's weights, it's not independent. If it is a non-profit that relies on donations from the very labs it claims to evaluate, it's a joke.
I have seen this exact pattern in my own work. In 2024, I was hired to evaluate a Bitcoin ETF issuer's cold storage multi-signature setup. The customer was the issuer. The payment came from their legal fund. I found a procedural flaw in their air-gapped key generation ceremony. They could have ignored my report and hired another auditor. They didn't, because I had enough reputation to push back. But the reputational pressure only works for a small set of high-profile auditors. For every one of me, there are a hundred firms that will pass anything for a fee.
So when I hear a Stanford professor call for "independent institutions," my first question is: where is the economic independence? Who pays the institution? And what happens when the institution makes a decision that harms a company's quarterly revenue?
The answer, historical data suggests, is regulatory capture.
Independent Oversight: The Devil in the Weights
Let me be brutally clear: even with perfectly funded, completely honest independent evaluators, there is a fundamental technical barrier to auditing an AI system. You cannot reproduce the evaluation.
In crypto, you can reproduce an audit. I can take the same contract, the same compiler version, the same environment, and I can verify the exploit. Reproducibility is the foundation of cryptographic security.
AI models are not reproducible in any meaningful sense. The weights are often proprietary. The training data is an opaque mixture of public and private data. The evaluation environment changes dynamically due to version updates, fine-tuning, and conditional inference. You cannot replicate the exact state of a frontier model. You cannot replay a safety test two weeks later and get the same result.
The crypto analogy would be: I audit a smart contract, but I am not allowed to see the code. I am only allowed to interact with the deployed bytecode through a black-box API. And the bytecode is updated daily without my knowledge. And the developer refuses to give me the compiler version or the source code. That is the world of AI safety evaluation.
Fei-Fei Li, to her credit, does not pretend this is easy. She says internal researchers "can measure individual model capabilities and safety properties." That is true. But she then says that measurement cannot replace broader standards. That implies the existence of an alternative: a broader standard, developed by government, industry, and academia.
That standard does not exist.
What exists: The Holistic Evaluation of Language Models (HELM) benchmark from Stanford. The ARC Evals dataset from the Alignment Research Center. The MLCommons AI Safety Benchmark. All are useful. All are limited.
HELM measures performance across a set of scenarios. It does not measure jailbreak resistance in production. ARC Evals conducted a physical-world test of GPT-4's ability to cause a pandemic via a biological weapon. They published a report. That was commendable, but it was a one-time effort. No regular evaluation. No theory of change.
Meanwhile, the technical barriers remain: model weights not disclosed, evaluation environments changing, benchmarks contaminated by training data. I can describe these from direct experience with a project I cannot name. In late 2025, I was contacted by a company that wanted to build a "blockchain-based AI audit protocol." They planned to let DAOs vote on whether an AI model was safe. I asked them how they would access the model weights. The answer was "the model provider would submit a zero-knowledge proof of the weights." That is technically impossible for a large transformer with billions of parameters and stochastic inference.
I concluded the protocol was a scam. It was one of those ideas that sounds decentralized but is actually centralized with extra steps. And that is exactly what most "AI governance" proposals will be.
The Open-Source Exception
There is one area where independent oversight is technically feasible: open-weight models. If the weights are public, you can audit the architecture. You can run your own red-team. You can reproduce evaluations. You can build deterministic safety checks.
This is why Fei-Fei Li's use of "advanced AI systems" rather than "all AI systems" is so interesting. It reflects a careful political choice. She is carving out a space for small, open, academic models—the kind that her own World Labs might build or collaborate with. She is not calling for regulation of a startup running a fine-tuned Llama model in a research lab. She is only targeting the frontier, the closed-weights behemoths.
That is the same logic as crypto's "decentralization exemption." When regulators propose a law, they often exempt truly decentralized systems. The problem is that "true decentralization" is rare. In AI, the frontier models are all more centralized than the second-largest exchange in 2019.
But the open-source exception has a grim irony. Open weights enable external scrutiny, but they also enable misuse. A malicious actor can fine-tune an open model with unlimited style and remove any safety guardrails. That is not a hypothetical. That is a fact. The same openness that makes auditing possible makes ablation possible.
Crypto faced the same dilemma. Open source code was auditable but also forkable. Attackers could take a vulnerable contract, modify it, and scam others. We still chose open source because the benefits outweighed the risks. But we never solved the dual-use problem. We just accepted it.
AI will have to accept the same. The solution is not to restrict open weights. It is to accept that some fraction of open models will be dangerous and that our defense must be in the deployment layer, not in the weight layer. That is a hard pill for regulators to swallow, but it is the only technically honest answer.
Can Blockchain Save AI Governance?
The blockchain industry, ever eager to attach itself to any trend, will try to sell the world on "decentralized AI safety." Smart contracts will be deployed to timestamp audit reports. DAOs will vote on model approvals. Tokens will incentivize white-hat hackers to probe models.
None of that addresses the root problem.
The root problem is not a lack of records. The root problem is that the subject being recorded—the behavior of a frontier AI model—is not a deterministic on-chain object. It is a probabilistic, evolving, context-dependent information processing system. You cannot timestamp a probability distribution and call it an audit.
Let me give you a concrete example. In crypto, a smart contract audit involves checking the bytecode against a specification. You define the invariants. You test them. The code either follows the invariant or it doesn't. With AI, the "specification" is a set of ethical principles. The model may violate those principles in a subtle way, and that violation may only appear under a specific prompt that no evaluator thought to test. The invariant is not a property of the code; it is a property of the model's latent representations, which are not enumerable.
Blockchain can help with the process—not the outcome. You can timestamp the model version. You can record which model weights were used for a particular deployment. You can store the evaluation results on-chain, immutably. If someone later claims a model was safe when it wasn't, you can point to the immutable record and say, "The record shows what the internal test found at that time."
But the record does not replace the independent institution. It only provides evidence for that institution to interpret. A blockchain cannot avoid the fundamental need for human or institutional authority. The chain remembers what the ledger forgets, but it also remembers what never existed.
Optimization is just risk wearing a disguise. Anyone who tells you that zero-knowledge proofs can prove an AI model's safety without revealing the weights is asking you to believe in magic. I have audited enough smart contracts to know that magic does not exist in code. It certainly does not exist in deep neural networks.
The Pre-Mortem: How This Will Fail
If Fei-Fei Li's call for independent oversight is acted upon, and I believe it will be, the failure mode is predictable. I am writing this as a pre-mortem, not a prophecy.
The first version of the independent oversight body will be funded by governments. It will be staffed by academics and former industry executives. It will have no enforcement power, but it will provide advisory opinions. The frontier labs will voluntarily participate. They will call it "collaborative" and "good-faith."
The evaluations will be too slow. By the time the independent body finishes a six-month assessment, the model will have been updated several times. The report will apply to an extinct version. Everyone will nod politely and ignore the findings.
Then the first major AI incident will happen. A deployed autonomous agent, or a chatbot with too much API access, will cause real financial or physical harm. The incident will be traced back to a failure in an independent safety evaluation. The press will ask: "Who approved this model?" The answer will be: "No one. The independent body never had the authority to approve or block."
And then the regulator will be created. It will have emergency powers. It will overcorrect. It will demand a level of evidence that is impossible to produce. It will defer to the model developers because they are the only ones who understand the code. And the cycle will continue.
This is not a bet against the concept of independent oversight. It is a bet against the current institutional architecture. Institutions lack the speed to keep up with AI. They lack the technical depth to make accurate judgments. They lack the legal authority to enforce their standards. And they lack the economic independence to resist capture.
I know these failures intimately. I worked with a mid-tier exchange after FTX collapsed. The legal teams needed my forensic report to prove misappropriation. My report was sterile, Excel-heavy, devoid of moral judgment. That was its power. But it could not have stopped FTX. A better report, earlier, would have been ignored because the institutional incentive to keep funding the exchange was too strong.
The same will happen with AI safety reports.
A Forensic View from the Swamp
Let me take you inside my actual life for a moment. I am a crypto security audit partner in Hangzhou. I have spent the better part of a decade dissecting code that has promised more than it delivered. I have read whitepapers that were elaborate ransom letters. I have seen smart contracts that were booby traps. I have watched auditors sign off on projects that later lost everything.
I, too, have been fooled. Not by code, but by people. The code never lies. The people do.
When I analyze a protocol, I don't start with the code. I start with the incentive graph: who gets paid, who loses, what happens when a token price drops 50%, what happens when a whale dumps. I look for asymmetric information. I look for single points of failure. I look for the phrase "trustless" used too often.
The same approach applies to AI governance claims. When I hear "independent safety evaluation," I want to know the funder. When I hear "public sector oversight," I want to know the agency will actually be empowered. When I hear "academic collaboration," I want to know whether the researchers have any access to weights or whether they are just evaluating a black-box API.
In my audit experience, every black-box API is hiding something. It may be hiding incompetence. It may be hiding hacks. It may be hiding a business model that requires obfuscation. But there is always a reason nobody wants you to inspect the machine.
Fei-Fei Li is a distinguished researcher. I do not question her motives. But I question the feasibility of her vision without some structural change in how AI models are developed and deployed. Perhaps the answer is not more oversight, but less opacity. Perhaps the answer is to force frontier labs to publish their evaluation methodology, their training data composition, and their model architecture to a trusted third party that can reproduce the tests. Perhaps robust model revisions should require a new external evaluation, not a self-reported update.
But even that requires the third party to be trusted. And trust is a variable, not a constant.
The Contrarian Angle: The Bulls Are Right
I am a cynical person. I have built my career on being the one who exposes flaws. But even I must acknowledge that Fei-Fei Li and her allies have identified a real problem and proposed a direction that is not wrong.
The counterintuitive insight is this: independent oversight, even if flawed, is still better than the status quo. A biased, slow, imperfect external audit has more value than an internal team that is structurally incapable of finding certain problems. The same is true in crypto. A mediocre auditor who is not paid by the project is more valuable than a brilliant auditor who is on the payroll.
There is also a hidden benefit to external oversight: it creates a paper trail. Even if the independent body lacks enforcement power, its reports become evidence. When the inevitable incident occurs, the report will be used in court. The lab will be forced to explain why it ignored the warning. That is not a small thing. It is the difference between a vague sense of failure and a legal liability.
Finally, the bulls are right that the public sector has a role. Governments can create liability frameworks. They can require incident reporting. They can mandate that municipal agencies use internal audits. They can use procurement as leverage. These are not technical fixes, but they do create accountability.
The challenge is not the principle. The challenge is implementation. And implementation is exactly where my industry—the blockchain industry—has the most to teach.
Takeaway
We need to stop pretending that independent oversight will arise naturally. It will not. It will arise only when a catastrophe makes it politically impossible to delay. The question is whether we want to wait for that catastrophe.
Code does not lie, but it does hide. And so do the institutions that certify it. The next few years will determine whether we build a frame of verification too weak to matter, or a frame strong enough to protect the public—without accidentally crushing the open ecosystem that gives us the only real transparency we have left.
I, for one, am not optimistic. But I am prepared. I will be there with a forensic microscope, documenting every lie, tracing every pattern, and writing down what I see.
Because when the AI incident happens, and it will happen, someone has to audit the aftermath.
The chain remembers what the ledger forgets. The AI forgets what the chain remembers. We must anchor one to the other before the next flash crash turns into a flash human extinction.
Or, more likely, we will not.
But I will keep my notebook open.