Instruments, measurement, experiments
Lab
Before the Institute, there was the Random Research Lab — a quieter name for the same instinct: that the goddess Τύχη, fortune and chance, sits at the root of cryptography and that the work most worth doing sometimes starts in a corner with a notebook rather than on the front page. The Lab is where that instinct still lives.
Everything on this page follows one discipline: a claim is only as good as the test that could have refuted it, so the tests ship with the claims as versioned, reproducible artefacts. The page has four parts — instruments you can open, the conformance and measurement harnesses behind the papers, the public research labs, and the experiments and cultural work the Institute grew out of. For peer-reviewable papers see Research; for the daily measurement series see Observatories.
The Lab publishes open research artefacts and test protocols. It does not offer conformity-assessment or certification services; where its work touches accredited evaluation, the relationship is one of open research about that world, not participation in its market.
Interactive instruments
Instruments you can open
Self-contained visual instruments and talk material from the Institute's evidence-infrastructure line. Each runs entirely in the browser, with no tracking and no external calls. The live demonstrations are deliberately breakable: a demonstration that cannot embarrass its authors is a brochure.
architecture · interactive
Accountable Agentic Action — the whole architecture
The full picture on one page: an autonomous agent acting under a machine-readable mandate carried in the EU Digital Identity Wallet, a four-layer verifier that stops it before any effect, hardware-attested evidence, and the four-box accountability chain — layer by layer, with origin and maturity called out, on the EATF framework.
capture the flag · runs the real verifier
Break the verifier
Edit a signed Action Evidence Package in your browser and run the reference verifier on it — the same ordered checks as the Python original, with real SHA-256 and Ed25519 via Web Crypto. Try to make it say ALLOW for an action the mandate never authorised; you cannot, without the keys, and that is the lesson. The in-browser verifier is parity-tested against verify.py on every sample and attack, as a build gate.
interactive demo · EUDI wallet · mandate enforcement
The agent that cannot overspend
An AI assistant is handed a wallet and a signed permission slip — pay invoices to one supplier, up to a €500 cap — while a verifier makes it physically unable to overspend, be scammed, or have a payment tampered with. Walk the four gates every payment must pass, in plain language.
interactive graph · measured daily · trusted-list observatory
The map of published trust
Every state that runs a trust framework publishes a list saying whom it vouches for, and the European Union publishes a list of those lists. This is the shape of the whole thing, fetched rather than described: two regional hubs with no edge between them, a scattering of lists nobody points at, and the pointers that do not answer a strict client.
interactive graph · EU digital acquis · NOMOS observatory
The EU digital acquis as one graph
eIDAS 2.0, the AI Act, GDPR, implementing acts, ETSI/CEN standards and the EUDI architecture framework rendered as segment-addressable nodes with typed cross-corpus edges and a coverage-honest gaps lens. This is the public tier-0 teaser; the row-level evidence layer is withheld pending peer review.
daily instrument · EUDI trust hub · NOMOS observatory
The six lists
The EUDI Wallet trust hub carries six "Lists of trusted entities". A scheduled probe asks the hub's own interface once a day whether each list is published yet, and keeps every answer — so the day the registers begin to fill is on the record. Includes the countdown to 24 December 2026, when relying-party registers must expose a public API.
console · SAFE AI · uncertainty certificates
Signed uncertainty certificate, policy gate
A research demonstration of an uncertainty certificate: a signed record of a measurement, its confidence bound, its assumptions and its validity window, fed to a policy gate that allows, denies or escalates. Seven mutation scenarios return DENY at every threshold, by design, and a paired bootstrap shows what the independence shortcut costs when two link scores share a sample. Not a compliance, conformity, or security certificate.
diagram · attestable agency
From presence to authority
Four rungs of machine-checkable legitimacy — bot-detection, hardware tokens, agent-legitimacy schemes, and per-action evidence — and why, once agents act on their own, the question worth defending climbs from "is there a human?" to "what did it do, under whose authority, in mandate?"
talk · agentic-AI evidence
Who Said the Agent Could Do That?
A talk on catching correctly-signed but out-of-mandate AI-agent actions, built around the public MIT-licensed aep-sandbox: an action whose every signature verifies is still rejected when it exceeds the mandate it was granted. Given on the main stage of BSides Tallinn on 25 September 2026.
posters · research snapshots
Posters and dated snapshots
Poster-format material and dated measurement snapshots from the same research lines. Snapshots record what was verifiably true on the stated day; the registers and schemes they describe are expected to change.
- Out of Mandate — A0 talk poster → Poster-scale summary of the agent-mandate talk: the legitimacy spectrum, the attack matrix, and the one command that rejects a correctly-signed, out-of-mandate action. Print-ready A0.
- The certification asymmetry — eIDAS 2.0, measured 5 Aug 2026 → Where Regulation (EU) 2024/1183 places assurance and where it does not: certified wallets, registered relying parties, and the state of six trust-hub lists on the measurement day.
- Accountable But Not Trackable — A0 poster (PDF) → Poster from the 2026 privacy-enhancing-technologies line. HTML version.
- Privacy and Assurance Tensions in EUDI Wallet Presentation Flows — A0 poster (PDF) → Poster from the 2026 privacy-enhancing-technologies line. HTML version.
- Privacy Boundaries — A0 poster (PDF) → Poster from the 2026 privacy-enhancing-technologies line.
Conformance & measurement
The harnesses behind the papers
The instrument side of the institute: the harnesses, corpora, and measurements that the papers rest on. Where a regulation promises an infrastructure, the measurement checks what is actually reachable; where a specification promises interoperability, the harness checks whether two implementations agree.
verifier conformance · two implementations, both built by us
Verifier parity harness
The action-evidence verifier exists twice — once in TypeScript, once in Python — and both are held to the same corpus of must-accept and must-reject cases: tampered payloads, swapped mandates, stripped signatures, expired and replayed evidence. The parity run executes on every build of this site; if the two implementations ever disagree about a single case, the site does not ship. Conformance here is not a claim, it is a build step.
daily measurement · EU digital identity
Trust-infrastructure observatories
Automated daily measurement of the trust infrastructure the EU digital identity ecosystem depends on, recorded as a public, versioned time series: the map of published trust lists, the six lists of the EUDI trust hub, and the network-evidence stream.
negative testing · versioned corpora
Negative test corpora
Every specification the institute publishes ships with the cases a conformant implementation must reject, not only the ones it must accept. The corpora are versioned, cited in the papers they support, and deposited with DOIs, so a third party can re-run the refutations without asking us anything.
interlaboratory comparison · round 0 open
An open interlab comparison for verifier conformance
Accreditation of testing laboratories presumes proficiency testing,
yet as of August 2026 no organised scheme exists for Common Criteria
evaluation work. Round 0 of our verifier-conformance track is open:
18 deterministically generated evidence packages, a fixed reason
vocabulary, and assigned values sealed by hash before the round
began, published in the aep-sandbox repository under
interlab/round0. Before any outside participant arrived
it produced a finding against us.
The long line: evaluation capacity as a research subject
Estonia currently has no accredited cybersecurity conformity-assessment body; the national certification authority's own page states it plainly. The European scheme that would use such bodies exists, the laboratories are concentrated in a handful of member states, and the entry path runs through accreditation, cross-border certification-body licensing, and witnessed evaluations. The Lab studies that path as a subject: what security-evaluation capacity costs, why small member states lack it, and which parts of the verification burden can be carried by open, reproducible instruments rather than by scarce accredited seats. The instrument corpus above is built so that, should the long line ever call for it, nothing has to be rebuilt.
Public research labs
Published, reproducible, open
Research lines that have reached a public, versioned release with a DOI. Each is an evidence lab rather than a brochure: the data, the checks and the limits are on the page.
public evidence lab · CEN/CENELEC · AI Act · multilingual standards
NORMTRACE — Standards Assurance as Join Integrity
An interactive, metadata-only lab that follows an AI Act duty through an exact CEN/CENELEC project state, dependency graph, required evidence object, human disposition, and signed, externally timestamped checkpoint.
Published v0.3.1 with a 12-body multilingual portal panel, a seven-chain AI-assurance spine, controlled LLM diagnostics, explicit missingness, and Zenodo DOI 10.5281/zenodo.21924089. It excludes standards full text and makes no conformity or semantic-truth claim.
interactive lab · RIPE Atlas · agent authority
From Permit to Packet
A breakable observatory for the full chain from a signed AI-agent mandate to an external RIPE Atlas effect, captured evidence, and a bounded public claim.
Published v0.1.0: 21 matched positive/negative pairs plus one clean baseline, 448 generated variations, a precommitted eight-measurement RIPE Atlas pilot, a scheduled repository-hosted re-verification, and Zenodo DOI 10.5281/zenodo.21923744.
public lab · X-Road · carrier-bound AI evidence
X-Road AI Evidence Lab
A reproducible lab on carrier-bound AI evidence: whether governed data-exchange infrastructure such as X-Road can carry and witness independently verifiable evidence about AI-agent actions.
The first public bundle is deposited on Zenodo, and the line has since produced three peer-reviewed outputs: the XATF profile in IEEE Access, the RAISE workshop study, and the XAI-EADM position paper. The next phase follows X-Road 8's shift toward dataspaces, verifiable credentials, cloud deployment, monitoring, and metrics.
Simulations
Public model sandboxes
These are exploratory synthetic simulations for asking better questions, not prediction engines or policy advice. They expose assumptions, scenario branches, and country-level sensitivity so a reader can see how conclusions change when parameters move.
synthetic wellbeing simulation · country replay · AI futures
Happy Scenario Atlas
An interactive explorer for Tyche's synthetic wellbeing simulations. It lets readers replay country, regional, and world-level scenarios for human flourishing and agentic-AI futures, using filters for harm risk, fragility, and modeled suffering effects.
The public build is refreshed from the institute's long-running simulation experiments, so the atlas can absorb new scenario evidence as the work continues.
Lines under formation
Early-stage research lines
These lines are early-stage research programmes rather than finished publications. They name the questions Tyche is beginning to organise into source maps, datasets, and future papers.
emerging lab · literature maps · dataset provenance
Literature + Dataset Evidence Lab
A curation line for turning thesis-scale crawling into publication-grade source packs: literature, datasets, proceedings, standards, regulatory material, source quality, reuse constraints, and citation readiness.
The first internal milestone is a source-family taxonomy and a dataset inventory with license, provenance, update cadence, and paper relevance.
emerging lab · AI governance readiness · Estonia-first
PALLAS — Country AI-Readiness Lab
A country-comparison line for AI-readiness as evidence infrastructure: legal basis, competent authorities, sandboxes, standards participation, algorithm registers, digital identity, PKI, cybersecurity, procurement, and auditability.
The first worked case is Estonia, followed by a Europe-first and then global comparison.
Experiments & cultural artefacts
From the Random Research Lab
Experiments, essays, and publications adjacent to the Institute's technical mission: the lab side of the house, kept because the notebook in the corner is where several of the research lines above began.
EN / RU / ET · interactive 3D tutorial · how GPT works
microGPT 3D Tutorial
A trilingual, browser-side 3D walkthrough of Karpathy's ~150-line microGPT — a complete GPT small enough that nothing is hand-waved: live attention beams, gradients flowing backward through a draggable graph, and a temperature slider on real generation. Adapted for junior AI researchers, with a foundations primer and glossary. Based on microgpt-3d-tutorial by lxb12123 (MIT).
RU / EN / ET · interactive study guide · adaptive education
Bayesian Knowledge Tracing Study Guide
A trilingual, interactive guide to Bayesian Knowledge Tracing, adaptive task selection, explainability, and classroom heatmaps — a safer flagship case for attestable educational AI where teachers remain in control and recommendations can leave replayable evidence.
RU / EN / ET · literary publication · public-key infrastructure
PKI-ZEN
A trilingual sūtra about certificates, YAML, and almost-enlightenment — a cultural companion to Tyche's technical work on trust infrastructure.
EN · open-data ML · water-quality risk
H2O Atlas
A probabilistic risk estimator for Estonian water-quality compliance, built on Terviseamet open data. It originated as a TalTech Masinõpe (spring 2026) coursework project and continues as a Tyche-side testbed for EATF — a transparency tool, not a health advisory.