A map of AI verification technologies
Technologies to externally verify claims about AI systems
- Goals are what a rule or agreement about AI sets out to achieve.
- Claims are what one party wants to verify.
- Mechanisms are general techniques for verifying a claim.
- Implementations are specific systems that realise a mechanism.
- Proposal Explorer lets you explore the coverage between selected sets of claims and mechanisms.
Claims and mechanisms
- Compute stock is at most a declared amount
- Chips are where they are declared to be
- Declared hardware is idle or shut down
- This compute runs inference, not training
- The declared model is the one being served
- Declared safeguards were applied during inference
- A training run stayed within declared limits
- Communication between compute groups is bounded
- Model weights have not left the facility
- There is no undeclared relevant compute
- The declared evaluation was run
On-chip & hardware-enabled
Compute stock is at most a declared amount
Implementations or supporting mechanisms only
- ProposedHardware performance throttling and licensingsupportingProposed on-chip mechanisms that cut an AI accelerator's performance when a license expires or a trusted trigger fires, bounding what the hardware can do.Assessed for performance limits a verifier can rely on, against an operator trying to bypass them. Medium confidence.
Compute accounting & provenance
Compute stock is at most a declared amount
1 mechanism aimed at this claim
- ProposedChip registries and manufacturing recordsRecording each AI chip's identity and owner from manufacture onwards, and publishing a cryptographic fingerprint of manufacturing records, so chips can be accounted for later.Assessed for a checkable record of which chips were made and who declared owning them. Medium confidence.
Remote & side-channel sensing
Compute stock is at most a declared amount
Implementations or supporting mechanisms only
- ProposedRemote detection of data centressupportingRemote detection tracks known large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records.Assessed for finding undeclared data centres above an agreed compute threshold. Medium confidence.
On-chip & hardware-enabled
Chips are where they are declared to be
Implementations or supporting mechanisms only
- ProposedHardware-enabled guarantees (flexHEG) and guarantee processorssupportingA proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.Assessed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence.
Cryptographic & computational
Chips are where they are declared to be
Implementations or supporting mechanisms only
- Research demoTimed challenge-response and memory-occupation challengessupportingA verifier times answers to unpredictable questions designed so that answering correctly and in time requires holding specified data locally or dedicating specified resources.Assessed for detecting whether a GPU is doing other work. Medium confidence.
Compute accounting & provenance
Chips are where they are declared to be
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
Declared hardware is idle or shut down
1 mechanism aimed at this claim
- Research demoOn-chip telemetry from timing, memory and performance countersOn-chip measurements, such as task timings, whether data sits in chip memory, and performance counters, used as statistical evidence of what AI chips are running.Assessed for workload evidence from GPU counters and timing, assuming authentic measurements. Medium confidence.
Also relevant
Cryptographic & computational
Declared hardware is idle or shut down
1 mechanism aimed at this claim
- Research demoTimed challenge-response and memory-occupation challengesA verifier times answers to unpredictable questions designed so that answering correctly and in time requires holding specified data locally or dedicating specified resources.Assessed for detecting whether a GPU is doing other work. Medium confidence.
Also relevant
On-chip & hardware-enabled
This compute runs inference, not training
1 mechanism aimed at this claim
- Research demoOn-chip telemetry from timing, memory and performance countersOn-chip measurements, such as task timings, whether data sits in chip memory, and performance counters, used as statistical evidence of what AI chips are running.Assessed for workload evidence from GPU counters and timing, assuming authentic measurements. Medium confidence.
Also relevant
Off-chip devices & sensors
This compute runs inference, not training
Implementations or supporting mechanisms only
- Research demoTamper evidence for verifier devicessupportingEnclosures, seals and sensors that make physical interference with verification hardware visible, or that destroy the hardware's secrets when tampering occurs.Assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence. Medium confidence.
- ProposedNetwork taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.Assessed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence.
- ProposedSASH confidential network loggerimplementationAn open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check the facility serves inference.Assessed for telling inference from training on a mutually inspected cluster. Medium confidence.
Cryptographic & computational
This compute runs inference, not training
Implementations or supporting mechanisms only
- Operational useDeterministic and bit-exact inferencesupportingMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.Assessed for reproducing open-model inference from receipts in Gensyn's information-market service. Low confidence.
- Operational useSampled inference recomputationsupportingA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.Assessed for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence.
- Research demoTimed challenge-response and memory-occupation challengessupportingA verifier times answers to unpredictable questions designed so that answering correctly and in time requires holding specified data locally or dedicating specified resources.Assessed for detecting whether a GPU is doing other work. Medium confidence.
- Research demoZero-knowledge proofs of inferencesupportingA prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.Assessed for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence.
- ProposedProofs of useful work for capacity accountingsupportingCryptographic evidence of matrix-multiplication work, from which total work is estimated statistically, proposed as one input to bounding the spare capacity of declared hardware.Assessed for bounding the spare capacity of declared hardware that could run training. Low confidence.
- ProposedData-centre memory challengingimplementationdraftA proposed design that times answers from a data centre's memory to check that declared data is present or that no free memory remains.Assessed for confirming data presence and bounding free memory across data-centre servers. Medium confidence.
Isolation & system architectures
This compute runs inference, not training
1 mechanism aimed at this claim
- ProposedWhole-workload recomputation (reproducible packets)Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.Assessed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence.
Also relevant
Remote & side-channel sensing
This compute runs inference, not training
1 mechanism aimed at this claim
- Research demoWorkload classification from telemetry and side channelsInferring from GPU counters or power draw whether chips are training models, serving them or doing non-AI work, without reading weights or data.Assessed for telling training from inference and other work using genuine telemetry, including disguised workloads. Medium confidence.
On-chip & hardware-enabled
The declared model is the one being served
Implementations or supporting mechanisms only
- Operational useTEE remote attestation for AI workloadssupportingTrusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with.Assessed for showing a verifier which software ran despite distrust of the hardware operator. Medium confidence.⚠
- ProposedHardware-enabled guarantees (flexHEG) and guarantee processorssupportingA proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.Assessed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence.
- Operational useApple Private Cloud ComputeimplementationApple's cloud AI inference service, in which user devices send requests only to servers that attest to running software published in a public transparency log.Assessed for showing users which software serves their AI requests, not which model. Medium confidence.
- Operational useWhatsApp Private ProcessingimplementationMeta's server system for WhatsApp AI features, whose clients check a confidential virtual machine's attestation and transparency-log proofs before connecting.Assessed for showing WhatsApp clients which logged software and artifacts serve their AI requests. Medium confidence.
- Research demoAttestable AuditsimplementationA research prototype that runs AI safety benchmarks inside a trusted execution environment (TEE) and publishes TEE-signed records linking the model, audit and results.Assessed for attesting a benchmark audit run on a confidential model in an enclave. Low confidence.
Off-chip devices & sensors
The declared model is the one being served
Implementations or supporting mechanisms only
- ProposedNetwork taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.Assessed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence.
- ProposedSASH confidential network loggerimplementationAn open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check the facility serves inference.Assessed for telling inference from training on a mutually inspected cluster. Medium confidence.
Cryptographic & computational
The declared model is the one being served
4 mechanisms aimed at this claim
- Operational useHardware-attested weight bindingChecks that a hardware enclave serves committed model weights, by attesting software that tests the weights against a hash commitment when they are read.Assessed for showing users, through hardware attestation, that a service runs its committed weights. Medium confidence.⚠
- Operational useSampled inference recomputationA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.Assessed for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence.
- Research demoConfidential multi-party verificationParties who distrust each other run an agreed check on private models or records, using attested enclaves or zero-knowledge proofs, releasing only the result.Assessed for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence.
- Research demoZero-knowledge proofs of inferenceA prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.Assessed for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence.
Also relevant
Isolation & system architectures
The declared model is the one being served
Implementations or supporting mechanisms only
- ProposedAI 2040 inference-only verification stackimplementationA proposed retrofit that splits data centres into isolated inference units, copies front-end traffic and re-runs random samples to confirm only declared inference runs.Assessed for showing that retrofitted data centres run only inference. Medium confidence.
- ProposedLow-trust AI compute verification system overviewimplementationA reference design that existing data centres could add: network taps hash all traffic, and air-gapped, independently sourced checkers later re-run randomly chosen records.Assessed for screening challenged records to show declared inference compute is not training. Medium confidence.
- ProposedRAND secure inference data center (SIDC) designimplementationA RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.Assessed for the operator's own weight security, with no outside verification described. Low confidence.
On-chip & hardware-enabled
Declared safeguards were applied during inference
Implementations or supporting mechanisms only
- Operational useTEE remote attestation for AI workloadssupportingTrusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with.Assessed for showing a verifier which software ran despite distrust of the hardware operator. Medium confidence.⚠
- ProposedHardware-enabled guarantees (flexHEG) and guarantee processorssupportingA proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.Assessed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence.
Cryptographic & computational
Declared safeguards were applied during inference
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
Declared safeguards were applied during inference
Implementations or supporting mechanisms only
- ProposedLow-trust AI compute verification system overviewimplementationA reference design that existing data centres could add: network taps hash all traffic, and air-gapped, independently sourced checkers later re-run randomly chosen records.Assessed for screening challenged records to show declared inference compute is not training. Medium confidence.
On-chip & hardware-enabled
A training run stayed within declared limits
1 mechanism aimed at this claim
- ProposedHardware-enabled guarantees (flexHEG) and guarantee processorsA proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.Assessed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence.
Also relevant
Off-chip devices & sensors
A training run stayed within declared limits
Implementations or supporting mechanisms only
- ProposedNetwork taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.Assessed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence.
Cryptographic & computational
A training run stayed within declared limits
2 mechanisms aimed at this claim
- Research demoTraining-transcript verification (proof-of-learning)A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened.Assessed for checking from its transcript that a training run followed declared rules. Medium confidence.⚠
- Research demoZero-knowledge proofs of training constraintsCryptographic proofs that a training run used a dataset and followed a procedure and rules fixed in advance, checkable without seeing the model or data.Assessed for proving a training run followed a committed specification and data. Medium confidence.
Also relevant
Isolation & system architectures
A training run stayed within declared limits
Implementations or supporting mechanisms only
- Research demoBandwidth limits and compartmentalizationsupportingCapping or removing network links between groups of AI chips, so each can serve models but pre-training beyond the current frontier becomes far slower.Assessed for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence.
- ProposedWhole-workload recomputation (reproducible packets)supportingOrganizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.Assessed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence.
Remote & side-channel sensing
A training run stayed within declared limits
Implementations or supporting mechanisms only
- Research demoWorkload classification from telemetry and side channelssupportingInferring from GPU counters or power draw whether chips are training models, serving them or doing non-AI work, without reading weights or data.Assessed for telling training from inference and other work using genuine telemetry, including disguised workloads. Medium confidence.
On-chip & hardware-enabled
Communication between compute groups is bounded
Implementations or supporting mechanisms only
- ProposedHardware-enabled guarantees (flexHEG) and guarantee processorssupportingA proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.Assessed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence.
Off-chip devices & sensors
Communication between compute groups is bounded
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
Communication between compute groups is bounded
1 mechanism aimed at this claim
- Research demoBandwidth limits and compartmentalizationCapping or removing network links between groups of AI chips, so each can serve models but pre-training beyond the current frontier becomes far slower.Assessed for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence.
Also relevant
Off-chip devices & sensors
Model weights have not left the facility
Implementations or supporting mechanisms only
- ProposedNetwork taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.Assessed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence.
Cryptographic & computational
Model weights have not left the facility
Implementations or supporting mechanisms only
- Operational useDeterministic and bit-exact inferencesupportingMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.Assessed for reproducing open-model inference from receipts in Gensyn's information-market service. Low confidence.
- Operational useSampled inference recomputationsupportingA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.Assessed for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence.
- Research demoDiFR (Divergence From Reference)implementationDiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.Assessed for checking that outputs match the declared model, precision and sampling settings. Medium confidence.
Isolation & system architectures
Model weights have not left the facility
1 mechanism aimed at this claim
- Research demoBounding unexplained information in outputsLimits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.Assessed for bounding how much hidden information can leave in checked inference outputs. Low confidence.
Also relevant
Compute accounting & provenance
There is no undeclared relevant compute
Implementations or supporting mechanisms only
- ProposedChip registries and manufacturing recordssupportingRecording each AI chip's identity and owner from manufacture onwards, and publishing a cryptographic fingerprint of manufacturing records, so chips can be accounted for later.Assessed for a checkable record of which chips were made and who declared owning them. Medium confidence.
Remote & side-channel sensing
There is no undeclared relevant compute
1 mechanism aimed at this claim
- ProposedRemote detection of data centresRemote detection tracks known large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records.Assessed for finding undeclared data centres above an agreed compute threshold. Medium confidence.
On-chip & hardware-enabled
The declared evaluation was run
Implementations or supporting mechanisms only
- Operational useTEE remote attestation for AI workloadssupportingTrusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with.Assessed for showing a verifier which software ran despite distrust of the hardware operator. Medium confidence.⚠
- Research demoAttestable AuditsimplementationA research prototype that runs AI safety benchmarks inside a trusted execution environment (TEE) and publishes TEE-signed records linking the model, audit and results.Assessed for attesting a benchmark audit run on a confidential model in an enclave. Low confidence.
Cryptographic & computational
The declared evaluation was run
1 mechanism aimed at this claim
- Research demoConfidential multi-party verificationParties who distrust each other run an agreed check on private models or records, using attested enclaves or zero-knowledge proofs, releasing only the result.Assessed for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence.
Also relevant
Each number counts the mechanisms in that category aimed directly at the claimimplementations or supporting mechanisms onlyExplore the claims and mechanisms graph →
Categories
- On-chip & hardware-enabled
- Mechanisms built into accelerators or their firmware: trusted execution, attestation, hardware-enabled governance, on-chip telemetry and limits.4 mechanisms · 4 implementations
- Off-chip devices & sensors
- Retrofittable devices outside the accelerator: network taps and certifiers, power and analog sensors, tamper-evident enclosures.3 mechanisms · 1 implementation
- Cryptographic & computational
- Protocols that check computation itself: recomputation, zero-knowledge proofs, proofs of learning, proofs of work, challenge-response.10 mechanisms · 18 implementations
- Isolation & system architectures
- Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.4 mechanisms · 3 implementations
- Compute accounting & provenance
- Establishing what compute exists, where it is and what it can do: chip registries, manufacturing records, location verification, capacity bounds.2 mechanisms · 1 implementation
- Remote & side-channel sensing
- Inferring activity from outside or from physical signals: detecting data centres, classifying workloads from power or other emissions.2 mechanisms