Invariant Blame

• If an invariant prior to the method fails, object was tampered
• If an invariant after the method fails, it was the method