{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "C-0005",
    "slug": "declared-model-is-served",
    "title": "The declared model is the one being served",
    "aliases": [
      "model identity",
      "model substitution"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Outputs delivered to users or auditors come from the specific model, weights and configuration the provider declared, not from a substitute.",
    "summary": "Evaluations, audits and agreements often apply to one specific model. If a provider could evaluate one model and serve another, such as a cheaper, quantized or modified version, those checks would say little about what users receive. It is a positive claim that can be tested directly, but three problems make it hard. Numerical nondeterminism means honest recomputation does not match exactly. The verifier usually cannot see the weights, which are commercially or strategically sensitive. And the evidence must come from the actual serving system rather than a separate test instance. Approaches include statistical or exact recomputation of sampled outputs, hardware attestation of the loaded weights, and zero-knowledge proofs. They trade off cost, trust in hardware vendors and confidentiality.",
    "claim_class": "positive",
    "editors_synthesis": {
      "assessment": true,
      "markdown": "The served model can be checked directly on its outputs, and several mechanisms for it are demonstrated (R2). None is deployment-ready (R3): independent security evaluations are either missing or, for trusted execution environments, found a critical flaw.\n\n[[M-0001|Sampled recomputation]] (R2) re-runs logged outputs on a trusted copy of the model, helped by [[M-0002|deterministic inference]] (R2); [[I-0001|TOPLOC]] and [[I-0002|DiFR]] implement it. [[M-0012|Model identity attestation]] (R2) uses [[M-0008|TEE remote attestation]] (R2) to show which weights an enclave loaded, as in [[I-0006]]. [[M-0004|Zero-knowledge proofs of inference]] (R2), such as [[I-0003|zkLLM]], keep weights private without trusting hardware. [[M-0025|Confidential multi-party verification]] (R2) binds audit results to the served model [[S-0009]].\n\nOn the authors' open-weight test models, Token-DiFR detected 4-bit quantization with AUC above 0.999 within 300 output tokens [[S-0016]]. zkLLM proves one inference of a 13-billion-parameter model in under 15 minutes [[S-0023]].\n\nEvidence must be tied to the production serving path, not a test instance, and recomputation needs the verifier, or an environment both sides trust, to hold the weights [[S-0018]]. Attestation rests on hardware keys: a published memory-bus attack with physical access extracted an Intel attestation key and forged attestations [[S-1202]]. Zero-knowledge proving remains expensive [[S-0018]].",
      "text": "The served model can be checked directly on its outputs, and several mechanisms for it are demonstrated (R2). None is deployment-ready (R3): independent security evaluations are either missing or, for trusted execution environments, found a critical flaw. Sampled recomputation (R2) re-runs logged outputs on a trusted copy of the model, helped by deterministic inference (R2); TOPLOC and DiFR implement it. Model identity attestation (R2) uses TEE remote attestation (R2) to show which weights an enclave loaded, as in Tinfoil model identity (Modelwrap). Zero-knowledge proofs of inference (R2), such as zkLLM, keep weights private without trusting hardware. Confidential multi-party verification (R2) binds audit results to the served model [S-0009]. On the authors' open-weight test models, Token-DiFR detected 4-bit quantization with AUC above 0.999 within 300 output tokens [S-0016]. zkLLM proves one inference of a 13-billion-parameter model in under 15 minutes [S-0023]. Evidence must be tied to the production serving path, not a test instance, and recomputation needs the verifier, or an environment both sides trust, to hold the weights [S-0018]. Attestation rests on hardware keys: a published memory-bus attack with physical access extracted an Intel attestation key and forged attestations [S-1202]. Zero-knowledge proving remains expensive [S-0018]."
    },
    "sources": [
      {
        "source": "S-0002",
        "supports": "Subgoal 1.A (declared uses declared accurately, including inference) and 1.B (required properties; deployed models evaluated at intervals)",
        "locator": "§3.2"
      },
      {
        "source": "S-0016",
        "supports": "need to verify inference; nondeterminism; Token-DiFR detects 4-bit quantization with AUC > 0.999 within 300 tokens",
        "locator": "abstract"
      },
      {
        "source": "S-1009",
        "supports": "batch-size dependence as a cause of inference nondeterminism",
        "locator": "batch invariance section"
      },
      {
        "source": "S-0020",
        "supports": "bit-exact reproduction across GPU variants given recomputation data",
        "locator": "abstract"
      },
      {
        "source": "S-0004",
        "supports": "model fingerprint attestation; device-model mating with an encrypted model",
        "locator": "Appendix K (p. 157); Appendix L.4 (p. 159)"
      },
      {
        "source": "S-0018",
        "supports": "whitelisted models for blacklisted uses; attributing forward passes to hardware and time; committed weights in auditing environments; ZKP cost",
        "locator": "verification goals; architecture; open problems"
      },
      {
        "source": "S-0023",
        "supports": "zkLLM proves 13B-parameter inference in under 15 minutes with proofs under 200 kB, keeping parameters private",
        "locator": "abstract"
      },
      {
        "source": "S-0012",
        "supports": "property attestation on Intel TDX + NVIDIA H100 with under 11% overhead for common operations",
        "locator": "abstract"
      },
      {
        "source": "S-0014",
        "supports": "attestation-key holder can produce valid reports; side-channel and physical attacks; measurement coverage",
        "locator": "Limitations"
      },
      {
        "source": "S-0009",
        "supports": "attestation linking model, audit result, prompt and response in a TEE",
        "locator": "abstract; inference protocol"
      },
      {
        "source": "S-1202",
        "supports": "physical memory-bus interposition extracts a per-CPU Intel attestation key and forges TDX attestations",
        "locator": "abstract; §1.1"
      },
      {
        "source": "S-1210",
        "supports": "Battering RAM forges SEV-SNP attestation with a DDR4 interposer"
      },
      {
        "source": "S-1212",
        "supports": "RMPocalypse forges SEV-SNP attestation from a malicious hypervisor"
      }
    ],
    "concepts": [
      "K-0009",
      "K-0008",
      "K-0004",
      "K-0006",
      "K-0010",
      "K-0019"
    ],
    "order": 5,
    "type": "claim",
    "url": "https://trustbutveri.fyi/claims/declared-model-is-served/",
    "source_file": "content/claims/declared-model-is-served.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "## Why it matters\nChecks on a model's capabilities or safety apply to the model that was checked. Several parties depend on that link:\n\n- **Agreement verifiers.** RAND's framework asks verifiers to confirm that declared inference is declared accurately, so that the prover actually did the claimed deployment [[S-0002]]. It then asks them to confirm that deployed models have the required properties, for example through evaluations at regular intervals [[S-0002]]. Both steps assume the evaluated model is the served model. A low-trust system overview identifies running approved models for prohibited uses as the most difficult violation to defend against, and aims to deploy only approved models [[S-0018]]. The Oxford Martin report includes appendices on model fingerprint attestation and on \"device-model mating\" with an encrypted model [[S-0004]].\n- **Customers.** The DiFR authors note that providers and their customers increasingly need to verify that inference is performed correctly, without errors or tampering [[S-0016]]. Their Token-DiFR method detected 4-bit quantization of a model with AUC above 0.999 within 300 output tokens [[S-0016]].\n\n## Why it is hard\n- **Noise.** Re-running the same inference often gives slightly different results because of benign numerical variation, which makes it hard to tell legitimate variation from substitution [[S-0016]]. In LLM serving a major cause is that kernels are not invariant to batch size, which varies with server load [[S-1009]]. Statistical tests tolerate this noise [[S-0016]]. Alternatively, Cankaya reports that inference can be reproduced bit-exactly across several NVIDIA GPU variants in software, given enough recorded information about the original run [[S-0020]].\n- **Confidentiality.** Recomputation requires the weights, which a provider or state may not reveal [[S-0018]]. One system design keeps weights cryptographically committed and uses them only inside air-gapped auditing environments [[S-0018]]. Zero-knowledge proofs avoid revealing weights at all. zkLLM reports proving a full inference of a 13-billion-parameter model in under 15 minutes, with proofs under 200 kB [[S-0023]], but the low-trust overview describes zero-knowledge proof computation as still expensive [[S-0018]]. Trusted execution environments can attest which software and data were loaded [[S-0014]]. PAL\\*M reports property attestation on confidential computing hardware (Intel TDX with NVIDIA H100) at under 11% overhead for common operations [[S-0012]].\n- **Binding.** Evidence about a test instance says nothing about production unless it is tied to the serving hardware and time. The low-trust design aims to identify each forward pass uniquely and attribute it to the hardware and time it was processed [[S-0018]]. TEE-based binding relies on the vendor's keys: whoever holds the hardware's attestation key can produce valid reports, and every component that influences inference must be covered by launch measurement [[S-0014]]. A published memory-bus interposition attack, which needs physical access, extracted a per-CPU Intel attestation key and forged Intel TDX attestations [[S-1202]]. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone before AMD's fix [[S-1210]] [[S-1212]].",
    "body_text": "Why it matters Checks on a model's capabilities or safety apply to the model that was checked. Several parties depend on that link: - Agreement verifiers. RAND's framework asks verifiers to confirm that declared inference is declared accurately, so that the prover actually did the claimed deployment [S-0002]. It then asks them to confirm that deployed models have the required properties, for example through evaluations at regular intervals [S-0002]. Both steps assume the evaluated model is the served model. A low-trust system overview identifies running approved models for prohibited uses as the most difficult violation to defend against, and aims to deploy only approved models [S-0018]. The Oxford Martin report includes appendices on model fingerprint attestation and on \"device-model mating\" with an encrypted model [S-0004]. - Customers. The DiFR authors note that providers and their customers increasingly need to verify that inference is performed correctly, without errors or tampering [S-0016]. Their Token-DiFR method detected 4-bit quantization of a model with AUC above 0.999 within 300 output tokens [S-0016]. Why it is hard - Noise. Re-running the same inference often gives slightly different results because of benign numerical variation, which makes it hard to tell legitimate variation from substitution [S-0016]. In LLM serving a major cause is that kernels are not invariant to batch size, which varies with server load [S-1009]. Statistical tests tolerate this noise [S-0016]. Alternatively, Cankaya reports that inference can be reproduced bit-exactly across several NVIDIA GPU variants in software, given enough recorded information about the original run [S-0020]. - Confidentiality. Recomputation requires the weights, which a provider or state may not reveal [S-0018]. One system design keeps weights cryptographically committed and uses them only inside air-gapped auditing environments [S-0018]. Zero-knowledge proofs avoid revealing weights at all. zkLLM reports proving a full inference of a 13-billion-parameter model in under 15 minutes, with proofs under 200 kB [S-0023], but the low-trust overview describes zero-knowledge proof computation as still expensive [S-0018]. Trusted execution environments can attest which software and data were loaded [S-0014]. PALM reports property attestation on confidential computing hardware (Intel TDX with NVIDIA H100) at under 11% overhead for common operations [S-0012]. - Binding. Evidence about a test instance says nothing about production unless it is tied to the serving hardware and time. The low-trust design aims to identify each forward pass uniquely and attribute it to the hardware and time it was processed [S-0018]. TEE-based binding relies on the vendor's keys: whoever holds the hardware's attestation key can produce valid reports, and every component that influences inference must be covered by launch measurement [S-0014]. A published memory-bus interposition attack, which needs physical access, extracted a per-CPU Intel attestation key and forged Intel TDX attestations [S-1202]. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone before AMD's fix [S-1210] [S-1212].",
    "addressed_by": [
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/",
        "role": "primary",
        "note": "Binds audit or capability-evaluation results to the model that is served, without revealing weights (S-0009, S-0011)."
      },
      {
        "id": "M-0002",
        "title": "Deterministic and bit-exact inference",
        "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/",
        "role": "primary",
        "note": "Enables exact-match recomputation checks that the declared model, weights and software setup produced the outputs."
      },
      {
        "id": "M-0009",
        "title": "Hardware-enabled guarantees (flexHEG) and guarantee processors",
        "url": "https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/",
        "role": "supporting",
        "note": "Deployment only to approved flexHEG devices, and verification of evaluation scores (S-0035)."
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/",
        "role": "primary",
        "note": "Core purpose: responses come from the declared weights."
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/",
        "role": "supporting",
        "note": "Replaying challenged records with the declared model checks which model produced outputs (S-1300, S-0067)."
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/",
        "role": "supporting",
        "note": "Property and audit attestations bind responses to a measured model (S-0012, S-0009)."
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/",
        "role": "primary",
        "note": "Checks that sampled recorded outputs are consistent with the declared model, precision and sampling settings."
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/",
        "role": "primary",
        "note": "Attests the software stack that produced responses, and the model too when paired with a weight commitment (see M-0012)."
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/",
        "role": "primary",
        "note": "Binds each proven output to committed weights and a public architecture."
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/",
        "role": "supporting",
        "note": "Recomputation checks sampled packets against the declared model."
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/",
        "role": "primary",
        "note": "Users can check that the model answering them is the audited one."
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/",
        "role": "primary",
        "note": "Attestable reports proving y = F(W, x, r) for committed weights W."
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/",
        "role": "primary",
        "note": "Checks that outputs are consistent with the declared model, precision and sampling configuration."
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/",
        "role": "supporting",
        "note": "Screening checks that the model is on an agreed whitelist."
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/",
        "role": "supporting",
        "note": "The compute sanctum checks resident weights against reference measurements before serving."
      },
      {
        "id": "I-0008",
        "title": "SASH confidential network logger",
        "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/",
        "role": "supporting",
        "note": "Recomputation uses another copy of the declared model (S-1320, S-1319)."
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/",
        "role": "primary",
        "note": "Clients check that the served weights match a committed root hash."
      },
      {
        "id": "I-0001",
        "title": "TOPLOC",
        "url": "https://trustbutveri.fyi/implementations/toploc/",
        "role": "primary",
        "note": "Checks that the provider produced outputs with the claimed model weights, prompt and precision."
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/",
        "role": "primary",
        "note": "Proves an output follows from committed weights and a public architecture."
      }
    ],
    "referenced_by": [
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/"
      },
      {
        "id": "M-0002",
        "title": "Deterministic and bit-exact inference",
        "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/"
      },
      {
        "id": "M-0009",
        "title": "Hardware-enabled guarantees (flexHEG) and guarantee processors",
        "url": "https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/"
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/"
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/"
      },
      {
        "id": "I-0008",
        "title": "SASH confidential network logger",
        "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/"
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/"
      },
      {
        "id": "I-0001",
        "title": "TOPLOC",
        "url": "https://trustbutveri.fyi/implementations/toploc/"
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/"
      },
      {
        "id": "C-0006",
        "title": "Declared safeguards were applied during inference",
        "url": "https://trustbutveri.fyi/claims/safeguards-were-applied/"
      },
      {
        "id": "K-0003",
        "title": "Positive and negative claims",
        "url": "https://trustbutveri.fyi/concepts/positive-and-negative-claims/"
      }
    ]
  }
}