Case 21 · Graduation Day

πCreds

Scored as if pitched to investors: a genuinely novel architecture — an oracle and an LLM inside a TEE issuing provenance-bound credentials over messy private data — with two sharp original threat models, delivered as a pure academic lightning talk: no names, no numbers, no evidence a system runs, and a self-deprecating close, while the strongest commercial signal (a live use case for trustless code audits) came from the audience, not the stage.

[unnamed on stage]7:10 pitchreviewed 2026-08-17

01 Scorecard · 12 dimensions

Problem

6"Credentials… are very limited to simple predicates" is a real, well-motivated gap — but framed as an academic gap, not a felt pain. Nobody in the story is suffering.

Why now

5"We know that LLMs are pretty good at this" is the hinge of the whole idea — but it's stated as one clause, never as an argument for urgency.

Insight / secret

7Semantic reasoning over unstructured data with provenance guarantees, plus the source-constrained adversary — a new corner of adversarial-ML space, named on stage.

Solution clarity

7The architecture lands in one pass: user → TEE → oracle fetches data → LLM + prompt → signed credential → verify attestation. Credential anatomy is unusually concrete.

Product / demo

2Nothing shown, nothing claimed to run. The only artifact spoken of is the paper "on Archive last month." [confirm: does an implementation exist?]

Moat

2None claimed — the open concedes "a somewhat crowded space, you could say," naming IC3's work without saying why this group wins it.

Market

2No buyer, no sizing, no vertical — the closest thing to a market is being "pretty excited about this for interacting with, like, proprietary agents."

Business model

1Absent. Normal for a research talk; fatal for an investor pitch.

Competition

4Honestly acknowledged ("quite a bit of work… out of IC3") and differentiated on the gap — but never framed as a claim to a defensible position.

Traction

2"I'm not sure we have any citations yet" is the spoken evidence — a joke at its own expense. The one real demand signal (a block-building use case) arrived in Q&A, unclaimed by the pitch.

Team

2"My group" — no names, no affiliations, no credentials spoken on stage.

The ask

1None — not even "read the paper" or "come find me." A 1 is normal for a talk, but this talk didn't even make the talk ask.

02 Klaff 5-lens audit · 2/5

Croc brainFAIL"Yeah. So I'll give a lightning talk on some research" is pure housekeeping. The espresso-machine line, 50 seconds in, is the real open.

FramePARTIALThe academic frame is held with quiet confidence ("which is actually something we can address") — but it's an analyst frame, never a prize frame.

STRONG arcPARTIALReal arc: gap → architecture → two threats → killer application. But no tension on the room, and no offer or ask beat at all.

Hot cognitionPASSAlice the coffee expert built from espresso machines; adversarial purchases; a verifier fine-tuning the expertise score "to be even or odd based on the demographics of the user." Vivid and memorable.

StatusFAIL"somewhat crowded space, you could say," "for better or for worse," and closing on "…being discussed where it matters, I guess." Charming in a seminar; status-lowering in a pitch.

THE ONE REORDER — Open on Alice's espresso machines (cut the housekeeping sentence), close on trustless code audits plus one concrete ask — and never end a talk on "I guess."

03 Delivery

Length

7:10

Pace

172 wpm

Fillers / 100 words

5.4

66 fillers ("like" ×26, "uh" ×17, "um" ×11) over the full recording including the Q&A tail. "Like" clusters hardest in improvised passages — the prepared spine is noticeably cleaner than the extemporaneous edges.

04 Beat-by-beat

Time	Beat	What works	The fix
0:00	Housekeeping open	Honest signposting ("I'll give a lightning talk on some research")	Cut it. Open on the example — the room should meet Alice before the word "credential"
0:20	Space + prior work	"Somewhat crowded space… work that's come out of IC3" — intellectual honesty earns a technical room	Follow the concession with why this group closes the gap the field left
0:50	Alice example	Over-18 predicate vs. "coffee expert if she's made lots of purchases of espresso machines" — the best 30 seconds of the talk	Promote it to the opening line
1:30	The gap named	"The missing gap is this semantic reasoning over unstructured data" — one clean sentence naming the contribution	Attach the why-now explicitly: LLMs just made this gap closable
1:50	Architecture	"Run an oracle and an LLM inside a TEE" — clear single-pass system walk with credential anatomy and attestation	Say whether it's built. "We propose" vs. "we run" is a paper vs. a product [confirm implementation status]
2:50	Threat 1 — adversarial user	"Has to work in this kind of source-constrained setting" — an original observation, correctly placed relative to prompt injection	Give it one number or result from the paper [confirm] — as spoken, both threats are hypotheses
3:30	Threat 2 — adversarial verifier	The even/odd demographic leak — the most memorable technical image in the talk	Keep. This is the line the room will repeat
4:00	Trustless code audits	"Binds the hash of some code to some property over it… without ever inspecting the source" — the commercial payload, and the beat that got real Q&A pull	Lead the last third with it and say who needs it (the Q&A answered: proprietary block builders, proprietary agents)
4:35	Malt book close	Funny, self-aware, human	The anti-close. Replace "I'm not sure we have any citations yet… I guess" with the application plus an ask
4:45	Q&A	An audience member volunteers "an active use case… like, block building related" and asks the killer question: "how good can we make this auditing?"	Claim the beat — the honest answer was given, but the demand signal went unharvested: no "let's talk after," no name taken

05 The gaps investors block on

No evidence anything runs — a paper on arXiv is spoken of; a system is not. [confirm: prototype status]
No results spoken — two threat models and one application, zero numbers from the paper.
No team — "my group" with no names or affiliations is unfundable as spoken.
No ask, not even a non-monetary one. The room was given nothing to do.
The auditing-quality question is open and admitted: the idea "came up kind of last minute" and formal properties are unexplored — exactly where diligence dies.
Trust framing gap: what a verifier must trust about the LLM itself (model pinning, prompt integrity, reproducibility) goes unmentioned.

The one strategic decision

Lead with trustless code audits. Option A: stay a research program — publish, get cited, define the threat models the field will use. Option B: lead with trustless code audits — the one application with demonstrated, unprompted pull (a room member had "an active use case" before the talk ended) and a crisp buyer shape: anyone running proprietary code others must trust. Recommendation: B, if this ever becomes a pitch. The honest gate is the presenter's own question — auditing quality — so the first milestone is an evaluation, not a customer.

“πCreds lets you trust code you're never allowed to read — an LLM inside an enclave audits it and signs a credential binding the code's hash to the property it verified.”

06 The rewritten pitch

From Alice's Amazon order history you can tell she's a coffee expert — she keeps buying espresso machines. No privacy-preserving credential system on earth can prove that about her, because credentials today only speak structured data: birthday in, over-18 out. Everything interesting about us is unstructured — orders, medical portals, code — and until now nothing could reason over it without reading it.

πCreds is that missing piece. We run an oracle and an LLM inside a trusted enclave: the oracle fetches your private data with provenance, the LLM evaluates one auditable prompt over it, and the enclave signs a credential — you verify the attestation, never the data. We published the architecture on arXiv [confirm: paper title + venue], and we've mapped the two attacks that matter: users gaming their own sources, and verifiers fine-tuning the model to leak what the credential shouldn't say — both live in a new, source-constrained corner of adversarial ML that we named.

The application we can't stop thinking about is trustless code audits: bind the hash of proprietary code to a property an LLM verified, and anyone can trust the code without ever seeing it. The first person who heard this talk had a use case waiting — proprietary block-building algorithms [confirm: permission to cite].

We're [names] from [group/institution]. The open question is how good LLM auditing can get — so the next milestone is [the eval: benchmark, target, date]. If you run code other people have to trust, come talk to me.

Brackets are the founder's homework — the copy is done, the proof is theirs to supply. Every claim must match what's actually built.

07 Do these before the next take

Decide the wedge: if this stays a talk, optimize for citations; if it aims at investors, lead with trustless code audits — the only beat with observed pull.
Harvest the Q&A demand signal now: follow up with the block-building questioner and turn "an active use case" into a named design-partner conversation. [confirm who they are]
Build the auditing eval — "how good can we make this auditing?" is the gating question; one benchmark with a number converts both threat models from hypotheses into results.
Say the names: "my group" → who you are, where, and why you're the ones. One sentence.
Replace the Malt-book close with an ask — keep the joke if it lands, but the last sentence must be something the room can do.
Filler drill on "like" (26 instances, clustered in improvised passages) — the prepared spine is already clean; rehearse the edges.