How the PublicAML risk score is derived

Two statements live side by side in the API and they are not interchangeable. Attribution answers who an address is: an exchange, a token contract, a named person. Risk answers what it costs: sanctioned, hacked funds, mixer output. They are stored apart, they are proved to different standards, and only one of them is an accusation.

The shape of the graph is a third thing again, and it never becomes an identity. An address that many others pay into is published as a hub with a structural basis, not as an exchange. When nobody has named it, the category is empty, and empty means nobody named it, not nothing is known.

The first axis is the category register. It states what is being alleged and carries, for each category, its own severity, its own reach and its own decay. A sanction, a hack, a mixer and a deposit address of a gambling venue are different statements with different weight, and that weight belongs to the statement, not to whoever made it.

The second axis is the trust table: one rank from 0 to 100 per source. Sanctions authorities and stablecoin issuers sit at 100, community reports at 25. One number per source, not per claim, so a source cannot be strong about one address and weak about the next.

The two are joined by a minimum, not by a weighted blend. The score at the point of origin is the lower of the category severity and the source rank. A weak source therefore cannot carry a heavy accusation, and a strong source cannot make a soft category heavy. Both of those failures are what a weighted average quietly allows.

Reach belongs to the category and is trimmed by the rank, never the other way round. A sanction survives depth by design and keeps an explicit score at each hop. A hack reaches six hops and loses 30 per cent of its weight on each of them. A mixer is terminal: value passing through it does not carry the accusation onward, and interaction with it is a different, much lighter claim.

The rank enters as a fraction of that reach, with a floor of one hop, so a source we trust less does not get the same radius as the authority that published the list. Below, the same hack claim from three sources of different rank.

Everybody pays an exchange, a bridge and a staking contract, so the neighbourhood of such an address is not evidence about it. Neutral categories therefore have their inherited exposure switched off. This is the one place where attribution touches the score, and it only ever lowers it.

It never touches the direct half. An accusation recorded against the address itself is published whatever the address is attributed as, and the only thing that clears it is a recorded human decision, held as its own row with its own author. No ranking, no category and no shape of the graph can retract an accusation on its own.

Every source statement about an address is held as its own row in a claims registry. The owner of the published row is chosen by rank, not by who wrote last, and a claim that loses is kept rather than overwritten. So the question who said this, and when, is answered from the record and not from our memory.

That is also what makes a disagreement legible. When a curated catalogue calls an address a utility contract and an authority calls it sanctioned, both statements are on file, the authority owns the published row, and the disagreement itself is visible instead of being averaged away.

Each entry that contributed to the score names the source address, the source, its rank, the alleged severity, the resulting score and the distance in hops. The arithmetic can therefore be reproduced from a single response, without access to anything of ours. Below, an abridged live answer for a wallet of Chatex, listed by OFAC.

Read the first row and the policy is visible: severity 100, rank 100, score 100, zero hops. Read the last and so is the decay: a hack alleged by an investigated incident is worth 90 at its origin and 30.87 three hops away. The halves above the table are the same arithmetic summarised: the direct half comes from the address itself, the indirect half is the strongest thing that reached it.

The primary evidence is not ours and does not need us. A sanction names the authority, the list, the date of the snapshot and the publication. An issuer freeze names the block and the transaction hash, which either exists on chain or does not. An incident names its documentary sources with their evidence tier and a link.

We also issue signed assessments in EIP-712 form, which any third party verifies with one ecrecover call and no account with us. One caveat, stated here rather than discovered later: the signature covers the subject address, the risk level and the validity window. The numeric score and the category travel alongside it, unsigned.

A methodology that only lists its strengths is not one. These are the places where the number is weaker than it looks, and each is a property of the current policy rather than a bug we are hiding.

• Propagation has no notion of time. A transfer made long before the accusation existed carries the same weight as one made after it.
• The score is not calibrated against outcomes. We publish no precision or recall figures, because we have not measured them, and a number we have not measured is not something to put in a table.
• Part of the trust ranks are still in editorial review. They are in force, and they are not all confirmed.
• Risk does not cross a chain boundary. The single exception is a direct sanction seed mirrored between EVM networks, and only for plain accounts, never contracts.
• Clustering is a structural inference. It never becomes an identity claim, but a wrong cluster can still place an address next to one.
• A claim is only as fresh as its last sync. Sanction and freeze sources are pulled daily, incident sources hourly, and between two runs we hold the previous snapshot.