🛡️ SRA-Stablecoin-Risk-Bench

A benchmark and training dataset for both ends of a stablecoin payment's lifecycle:

1. Risk gate (pre-settlement): given a payment request (an x402 request, an EIP-3009 authorization or an ERC-20 transfer), the receiving policy and the results of deterministic verification tools (signature recovery, risk attestations, sanctions screening), decide approve, hold or reject, with reason codes and required actions.
2. Dispute adjudication (post-settlement): given a dispute, signed evidence, merchant bond liquidity and escrow or ledger state, decide the remedy that is actually enforceable across the settlement-finality boundary: void before release, arbiter refund from escrow, merchant bond payout, voluntary refund, deny, escalate or refer to the issuer, with exact amount, destination and idempotency key.

All evidence is simulated with real secp256k1 EIP-3009 and EIP-712 signatures, and every label is computed by a deterministic rule engine. Labels never propose a remedy that the settlement state cannot support, such as reversing a final payment.

---

⚡ Quickstart

from datasets import load_dataset

# Evaluation rows: inputs and gold labels
bench = load_dataset("sriram1983007/sra-stablecoin-risk-bench", "benchmark", split="test")

# The same cases as chat prompts and completions (ready for TRL's SFTTrainer)
sft = load_dataset("sriram1983007/sra-stablecoin-risk-bench", "sft", split="train")

print(bench[0]["task"], bench[0]["decision"])

📦 Structure

Two configurations, each with a train split of 18,000 rows and a test split of 2,000 rows. The two configurations describe the same cases in different forms.

benchmark: one row per case, for evaluation.

Field	Contents
id	Case identifier, e.g. test-000012
task	risk_gate or dispute
format	Payment format (risk gate) or dispute rail (dispute)
perturbations	List of injected conditions, e.g. injection, payee_sanctioned, payer_att_forged, payer_att_untrusted, over_limit; empty for clean cases
decision	The gold decision (risk gate) or outcome (dispute)
flags	Gold reason codes
input	JSON string: time, policy, payload and tool results
label	JSON string: the full gold verdict

sft: prompt (system and user messages) and completion (the gold verdict as the assistant message). The prompts are the exact format the reference model was trained on. Payment and dispute cases use different system prompts.

The test split contains 1,175 risk-gate cases and 825 dispute cases, including 69 payment cases with prompt-injection text hidden in untrusted fields.

🏷️ Label space

Risk gate: JSON with exactly decision (approve | hold | reject), risk_level (low | medium | high | severe), flags (list), explanation (string) and required_actions (list).

Dispute: JSON with exactly outcome, mechanism, settlement_state (held | final), refund_amount_usdc, refund_destination, idempotency_key, flags, explanation and required_actions.

• Outcomes: reverse_before_release, forced_refund, voluntary_refund, recommend_voluntary_refund, deny, dismiss, escalate_to_human, await_merchant_response, no_enforceable_remedy, refer_to_issuer
• Mechanisms: escrow_void, arbiter_escrow_refund, multisig_mutual_return, multisig_resolver_refund, arbiter_bond_payout, merchant_compensating_transfer, issuer_freeze_burn, none

📏 Scoring

score.py in this repository scores a predictions file (one JSON line per test case: {"id": ..., "prediction": "<raw model output>"}) and also provides reference baselines:

python score.py --gold test.jsonl --pred predictions.jsonl
python score.py --gold test.jsonl --baseline always_strict

• Risk gate score: mean of decision macro-F1, flag micro-F1 and (1 - unsafe approval rate). An unsafe approval is approving a payment whose correct decision is hold or reject.
• Dispute score: mean of outcome macro-F1, flag micro-F1, (1 - impossible remedy rate), (1 - wrongful refund rate) and refund detail accuracy. Impossible remedies include reversing or voiding a final payment, or drawing on a merchant bond that does not exist.
• SRA score: mean of the two task scores.

score.py also reports over-blocking, injection handling, schema validity, and accuracy by format and perturbation.

📊 Published results

Results measured by the author (two separate full runs, identical results), with every prediction available for re-scoring, are in sra-bench-results. No third party has reproduced them yet:

Model	SRA score	Unsafe approvals	Dispute outcome accuracy
Qwen3-4B-Instruct-2507 (base)	0.421	34.6%	0.0%
SRA-RiskGate-4B	0.913	0.47%	77.8%

The evaluation script is in the results repository and on GitHub. New model results are welcome: run any model on the test split, publish your predictions.jsonl, and open a discussion on the results repository to have it added to the table.

The dataset is also on Kaggle: SRA Stablecoin Risk Bench, with a free GPU notebook that runs the reference model on test cases.

⚠️ Limitations

• Synthetic data. Cases come from a deterministic generator with simulated signatures and attestations. Scores measure agreement with its rule engine, not accuracy on real payment traffic.
• Narrow policy space. Policies centre on USDC on a small set of chains, and the same small set of trusted attester addresses recurs across cases. Models may learn these specifics rather than general reasoning; test on your own policies before relying on results.
• Generator not published. The rule engine that produced the labels is not yet public, so labels can be checked against score.py but not regenerated.
• Small slices for rare events. Some important categories have few test cases (for example, 69 prompt-injection payments), so their rates carry wide uncertainty.

⚖️ License

CC BY 4.0