Inspiration

Every drug trial rests on two assumptions: the data is real, and nobody at the site knows who got the real drug. Both are usually checked after the trial, if at all. And AI just made faking medical data cheap. A 2025 JAMA Ophthalmology study showed a custom GPT could produce fabricated datasets that passed forensic checks as authentic. We wanted to attack a trial before a single patient is enrolled, the way a bank hires penetration testers before real attackers show up.

What it does

Probe writes down a trial's Integrity Contract, the promises it has to keep, and searches for counterexamples. Impostor is an AI that fabricates a fake clinic and rewrites its own code round after round to slip past fraud monitoring, with every line running in an isolated Daytona sandbox. Patch turns every escape into a lesson: it learns a new fraud check and adds it to the monitor only if false alarms on honest clinics stay flat. Tell looks at only what site staff can see and tries to guess who got the real drug, and if it can, the blind is leaking. Seal finds the cheapest real-world fix that closes the leak, and reports the honest tradeoff when a clean fix isn't free.

How we built it

Python and FastAPI on the backend, a Next.js frontend. The trial is semi-synthetic: real patient physiology from NHANES with a simulated trial layer on top, so we always know the ground truth and can actually measure whether an attack succeeded. The fraud monitor, Sentinel, uses published central-statistical-monitoring methods. The attacker is a real LLM whose code runs only in Daytona sandboxes with no network access. Tell uses a classifier with cross-validation grouped by site and a permutation null, so above chance is proven, not luck, and its features are defined and served through Chalk's feature store with the treatment label kept out entirely. A strict firewall meant whoever built the leak detector never saw how the leaks were generated.

What we're proud of

We didn't just show that AI can fake trial data, that's been done. We put the faker and the monitor in a loop, hardened the monitor, and proved it generalizes. Sentinel v1 caught every escape across 4 attack runs it never trained on, with false alarms unchanged at 3.9%. On the blind, the coordinator's own paperwork predicts treatment 74.9% of the time, and we show the honest cost of each fix. Every number here was measured. Nothing is a target.

Challenges we faced

Getting an adaptive attacker to actually converge took richer, specific feedback before it could learn to evade. Keeping the evaluation honest meant frozen thresholds, held-out attack runs, a mechanisms-off control that must sit at chance, and a bias firewall between the attack and defense sides. And running untrusted AI-written code safely, which Daytona's sandboxes solved cleanly.

What we learned

The hard part of trial integrity isn't detection, it's proving a fix works against something you haven't seen yet. The most honest result is often a tradeoff, not a clean win.

What's next

Testing the hardened monitor against a different-model attacker, a richer utility model for the fix tradeoffs, and running on a sponsor's own historical trials.