Readiness levels

for bounding how far a chip is from trusted landmark servers when checked

for a checkable record of which chips were made and who declared owning them

for performance limits a verifier can rely on, against an operator trying to bypass them

for checking and enforcing training-compute limits on chips, against adversaries up to states

for showing that no data from earlier work persists in memory the wipe reaches

for committing a complete record of cluster traffic, so declared inference can be checked

for bounding the spare capacity of declared hardware that could run training

for finding undeclared data centres above an agreed compute threshold

for bounding physical covert channels out of a verified enclosure

for recomputing whole workloads to show a cluster runs only declared inference

for showing that retrofitted data centres run only inference

for proving an output came from committed weights

for confirming data presence and bounding free memory across data-centre servers

for screening challenged records to show declared inference compute is not training

for certifying the region where an attested workload ran at a given time

for the operator's own weight security, with no outside verification described

for telling inference from training on a mutually inspected cluster

for monitoring inter-node traffic with operator-run software on four GPUs

for bounding how much hidden information can leave in checked inference outputs

for audits or evaluations of a private model that reveal neither party's inputs

for workload evidence from GPU counters and timing, assuming authentic measurements

for attesting that a declared safeguard mediated a service's responses

for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence

for detecting whether a GPU is doing other work

for checking from its transcript that a training run followed declared rules

for telling training from inference and other work using genuine telemetry, including disguised workloads

for proving a language model's output follows from committed weights, against a cheating prover

for proving a training run followed a committed specification and data

for showing users that the model answering them is the audited one

for exact recomputation of served outputs by a verifier, with a cooperating provider

for composing owner-approved confidential workflow stages on Intel TDX

for checking that outputs match the declared model, precision and sampling settings

for proving a language model's output follows from committed weights, against a cheating prover

for detecting another workload running on the same GPU

for proving gradient-descent training of small image models on committed data

for attesting declared model operations on a confidential CPU–GPU prototype

for evaluating a private model on private prompts, neither party seeing the other's inputs

for attesting code execution on a GPU that lacks hardware trusted-execution support

for proving single-sample LoRA fine-tuning steps for 3–13-billion-parameter language models

for detecting whether verifier-supplied data remains in a single GPU's memory

for proving an output came from committed weights, against a prover who cheats

for reproducing open-model inference from receipts in Gensyn's information-market service

for showing users that a service runs the declared model weights

for checking untrusted workers' activations against the declared model, prompt and precision

for showing which software ran to a party that distrusts the operator holding the hardware

for showing users which software serves their AI requests, not which model

for checking matrix-multiplication work proofs for blockchain consensus

for showing clients that the served weights match a committed hash

for checking that untrusted providers used the claimed model, prompt and precision

for reproducing declared-model inference from receipts in Gensyn's information-market service