A map of AI verification technologies
This site maps the technical side of AI verification: the claims one party might want to check about another party's AI hardware or software, the mechanisms that could check them, the implementations that exist, and the organizations doing the work.
10 claims · 25 mechanisms · 16 implementations · 23 organizations · 212 sources
Claims and mechanisms
Each number counts the mechanisms in a category that are aimed directly at a claim. Supporting mechanisms and implementations are not counted. Select a number to see the mechanisms.
- Compute stock is at most a declared amount
- Chips are where they are declared to be
- Declared hardware is idle or shut down
- This compute runs inference, not training
- The declared model is the one being served
- Declared safeguards were applied during inference
- A training run stayed within declared limits
- Communication between compute groups is bounded
- Model weights or data have not left the facility
- There is no undeclared relevant compute
On-chip & hardware-enabled
Compute stock is at most a declared amount
Supporting work only
Compute accounting & provenance
Compute stock is at most a declared amount
1 mechanism aimed at this claim
Remote & side-channel sensing
Compute stock is at most a declared amount
Supporting work only
On-chip & hardware-enabled
Chips are where they are declared to be
Supporting work only
Cryptographic & computational
Chips are where they are declared to be
Supporting work only
Compute accounting & provenance
Chips are where they are declared to be
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
Declared hardware is idle or shut down
1 mechanism aimed at this claim
Also relevant
Cryptographic & computational
Declared hardware is idle or shut down
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
This compute runs inference, not training
1 mechanism aimed at this claim
Also relevant
Off-chip devices & sensors
This compute runs inference, not training
1 mechanism aimed at this claim
Also relevant
Cryptographic & computational
This compute runs inference, not training
Supporting work only
- R3Sampled inference recomputationsupportingA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.
- R2Deterministic and bit-exact inferencesupportingMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.
- R2Zero-knowledge proofs of inferencesupportingA prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.
- R1Proofs of useful work and resource exhaustionsupportingCryptographic evidence that hardware performed a given amount of agreed computation, proposed as a way to show no spare capacity remained for other work.
- R1Timed challenge-response and memory-occupation challengessupportingA verifier sends unpredictable questions that a device can answer in time only if it holds specified data, or dedicates specified resources, locally.
- R1Attestable zero-knowledge inference proverimplementationAttestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second.
Isolation & system architectures
This compute runs inference, not training
1 mechanism aimed at this claim
Also relevant
- R2Bounding unexplained information in outputssupporting
- R1Bandwidth limits and compartmentalizationsupporting
- R1Memory wiping and proofs of secure erasuresupporting
- R1AI 2040 inference-only verification stackimplementation
- R1Low-trust AI compute verification system overviewimplementation
- R1RAND secure inference data center (SIDC) designimplementation
Remote & side-channel sensing
This compute runs inference, not training
1 mechanism aimed at this claim
On-chip & hardware-enabled
The declared model is the one being served
1 mechanism aimed at this claim
Also relevant
Off-chip devices & sensors
The declared model is the one being served
Supporting work only
- R1Network taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.
- R1SASH confidential network loggerimplementationAn open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference.
Cryptographic & computational
The declared model is the one being served
5 mechanisms aimed at this claim
- R3Model identity attestation, open critical flawEstablishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.
- R3Sampled inference recomputationA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.
- R2Confidential multi-party verificationLets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.
- R2Deterministic and bit-exact inferenceMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.
- R2Zero-knowledge proofs of inferenceA prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.
Also relevant
- R2Safeguard attestationsupporting
- R3Tinfoil model identity (Modelwrap), open critical flawimplementation
- R3TOPLOCimplementation
- R2Attestable Auditsimplementation
- R2Batch-invariant inference kernels (Thinking Machines)implementation
- R2DiFR (Divergence From Reference)implementation
- R2EZKLimplementation
- R2Verde and RepOps (Gensyn)implementation
- R2zkLLMimplementation
- R1AI 2040 inference-only verification stackimplementation
- R1Attestable zero-knowledge inference proverimplementation
- R1Low-trust AI compute verification system overviewimplementation
- R1SASH confidential network loggerimplementation
Isolation & system architectures
The declared model is the one being served
Supporting work only
- R1AI 2040 inference-only verification stackimplementationA proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs.
- R1Low-trust AI compute verification system overviewimplementationA retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.
- R1RAND secure inference data center (SIDC) designimplementationA RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.
On-chip & hardware-enabled
Declared safeguards were applied during inference
Supporting work only
- R3TEE remote attestation for AI workloads, open critical flawsupportingTrusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.
- R1Hardware-enabled guarantees (flexHEG) and guarantee processorssupportingProposed chip add-ons, a guarantee processor inside a tamper-protected enclosure, that would check and enforce agreed rules on how AI accelerators are used.
- R2Attestable AuditsimplementationA research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results.
Cryptographic & computational
Declared safeguards were applied during inference
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
Declared safeguards were applied during inference
Supporting work only
On-chip & hardware-enabled
A training run stayed within declared limits
1 mechanism aimed at this claim
Also relevant
Cryptographic & computational
A training run stayed within declared limits
2 mechanisms aimed at this claim
- R2Proof-of-learning and training-transcript verification, open critical flawA trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened.
- R2Zero-knowledge proofs of training constraintsCryptographic proofs that a training run followed a committed dataset, procedure and rules, checkable without revealing the model or the data.
Also relevant
Isolation & system architectures
A training run stayed within declared limits
Supporting work only
- R1Bandwidth limits and compartmentalizationsupportingCapping or removing the network links between groups of accelerators, so that serving models still works but large training runs become impractically slow.
- R1Reproducible computation packetssupportingOrganizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.
Remote & side-channel sensing
A training run stayed within declared limits
Supporting work only
On-chip & hardware-enabled
Communication between compute groups is bounded
Supporting work only
Off-chip devices & sensors
Communication between compute groups is bounded
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
Communication between compute groups is bounded
1 mechanism aimed at this claim
Also relevant
Off-chip devices & sensors
Model weights or data have not left the facility
Supporting work only
- R1Network taps and certifierssupportingDevices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.
- R1Side-channel suppression for isolated facilitiessupportingShielding, filtering, jamming and inspecting an AI facility so that no hidden physical channel can bypass the checks placed on its official links.
Cryptographic & computational
Model weights or data have not left the facility
Supporting work only
- R3Model identity attestation, open critical flawsupportingEstablishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.
- R3Sampled inference recomputationsupportingA verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.
- R2Deterministic and bit-exact inferencesupportingMaking model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.
- R2DiFR (Divergence From Reference)implementationDiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.
Isolation & system architectures
Model weights or data have not left the facility
1 mechanism aimed at this claim
Also relevant
On-chip & hardware-enabled
There is no undeclared relevant compute
Supporting work only
Cryptographic & computational
There is no undeclared relevant compute
1 mechanism aimed at this claim
Also relevant
Isolation & system architectures
There is no undeclared relevant compute
Supporting work only
Compute accounting & provenance
There is no undeclared relevant compute
Supporting work only
- R1Chip location verificationsupportingTiming a chip's signed replies to trusted servers at known places, so that the speed of light bounds how far away the chip can be.
- R1Chip registries and manufacturing recordssupportingRecording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later.
Remote & side-channel sensing
There is no undeclared relevant compute
1 mechanism aimed at this claim
Categories
Mechanisms are grouped by where they act: on the chip, next to it, in cryptography, in the system architecture, in accounting, or from a distance.
- On-chip & hardware-enabled
- Mechanisms built into accelerators or their firmware: trusted execution, attestation, hardware-enabled governance, on-chip telemetry and limits.4 mechanisms · 2 implementations
- Off-chip devices & sensors
- Retrofittable devices outside the accelerator: network taps and certifiers, power and analog sensors, tamper-evident enclosures.3 mechanisms · 1 implementation
- Cryptographic & computational
- Protocols that check computation itself: recomputation, zero-knowledge proofs, proofs of learning, proofs of work, challenge-response.10 mechanisms · 9 implementations
- Isolation & system architectures
- Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.4 mechanisms · 3 implementations
- Compute accounting & provenance
- Establishing what compute exists, where it is and what it can do: chip registries, manufacturing records, location verification, capacity bounds.2 mechanisms · 1 implementation
- Remote & side-channel sensing
- Inferring activity from outside or from physical signals: detecting data centres, classifying workloads from power or other emissions.2 mechanisms
Readiness runs from R0 (idea) to R4 (deployment-ready). It is an editorial judgment under a published rubric, shown apart from the facts. About this site.