{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "M-0012",
    "slug": "model-identity-attestation",
    "title": "Model identity attestation",
    "aliases": [
      "Model integrity verification",
      "Proving which model is served",
      "Weight commitment and attestation",
      "Model provenance attestation"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "Establishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.",
    "summary": "Users, auditors and regulators often need to know that a provider is serving the model it declared, not a cheaper, altered or unevaluated one. There are two routes. First, the weights are committed to a hash, and the attestation from a trusted execution environment shows that the measured software enforced that commitment while the model ran. Second, a verifier that holds the declared weights recomputes a sample of logged outputs, which can also detect weights smuggled out in responses. Tinfoil reports running the enclave route in a commercial service, and its Modelwrap tool is open source. Research prototypes bind evaluations and inference to model hashes, and recomputation has been tested on models of up to 30 billion parameters. The enclave route inherits the weaknesses of TEEs, including published attacks that forge Intel TDX and AMD SEV-SNP attestations. Recomputation needs trusted logging and randomness, and must tolerate numerical nondeterminism.",
    "technical": "- **Modelwrap build (Tinfoil's description).** The tool downloads a pinned model revision, normalizes its directory structure and builds an EROFS image. It computes a dm-verity root hash with veritysetup. The Merkle tree gives a 32-byte commitment to, for example, 140 GB of weights [[S-0013]].\n- **Binding and enforcement.** The root hash is passed on the kernel command line, which the enclave measurement covers. dm-verity then checks every block read against it and returns an error on any mismatch [[S-0013]].\n- **Reported costs.** Tinfoil reports a hash-tree overhead of about 0.8% of image size, and build times from 5 s for a 549 MB model to 13 min 25 s for a 554 GB model. Cold-cache loading takes about 80% longer, and inference is unaffected once the weights are in GPU memory [[S-0013]].\n- **PAL\\*M inference attestation.** PAL\\*M sets the Intel TDX REPORTDATA field to the concatenation of the operation, a challenge, and hashes of the inputs and outputs. It supports single-prompt and multi-turn inference attestations. Across three models on an H100, total observed overhead was 3.8–11.4% for multi-turn sessions and 45.5–66.4% for single prompts [[S-0012]].\n- **Fixed-seed sampling likelihood.** Rinberg et al. score the likelihood that each token was honestly sampled from the claimed model under a known seed, with estimators for inverse-probability-transform and Gumbel-max samplers. On a 30B mixture-of-experts model under benign prompt traffic, the check limits exfiltratable information to under 0.5% at a false-positive rate under 0.01%, a slowdown of more than 200 times for the adversary [[S-0015]]. An independent study found that an adversary who controls the prompts roughly doubles leakage per token, reducing the slowdown to 60–118 times [[S-1507]].",
    "category": "cryptographic-computational",
    "secondary_categories": [
      "on-chip"
    ],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Core purpose: responses come from the declared weights."
      },
      {
        "claim": "C-0006",
        "role": "supporting",
        "note": "Links an attested evaluation to the model later served (S-0009)."
      },
      {
        "claim": "C-0009",
        "role": "supporting",
        "note": "The recomputation variant limits steganographic weight exfiltration through outputs (S-0015)."
      }
    ],
    "threat_model": "semi-trusted",
    "adversarial_evaluation": "independent-red-team",
    "hardware_requirement": "existing-features",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [
      {
        "target": "M-0008",
        "note": "The enclave variant relies on TEE and GPU attestation."
      },
      {
        "target": "M-0001",
        "note": "The recomputation variant is a form of sampled inference recomputation."
      }
    ],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2. Public code runs on production hardware, but the independent attacks published so far left flaws open, including a critical flaw in the trusted execution environments the enclave route relies on.\n\n- **R1** met: designs and assumptions are published for both routes [[S-0013]] [[S-0012]] [[S-0015]].\n- **R2** met through [[I-0006|Tinfoil's Modelwrap chain]]. Its code is open source [[S-1209]], it runs on NVIDIA H100, H200 or B200 GPUs with AMD SEV-SNP or Intel TDX (provider-reported) [[S-1206]], and it has been reported on models of up to 554 GB [[S-0013]]. Rinberg et al. publish code and results on models from 3B to 30B parameters [[S-0015]].\n- **R3** not met. Criterion (a) is met only on the provider's account: Tinfoil reports offering the feature in a production service [[S-1207]] [[S-1208]]. Criterion (b) fails, because the independent evaluations that exist left flaws open. TEE.fail used physical access to forge the Intel TDX attestation that the enclave route relies on. By pairing the forgeries with relayed H100 attestations, it made a vLLM proxy running outside TEE protection pass both the TDX and the NVIDIA confidential-computing checks [[S-1202]]. That flaw is critical and open. Kezins, at Delft University of Technology, attacked the exfiltration bound of Rinberg et al.'s recomputation check with chosen prompts. On a 30B mixture-of-experts model this raised leakage from 0.119 to 0.286 bits per token. The attack widens the covert channel and does not target the check that outputs match the declared model [[S-1507]].",
      "evidence": [
        "S-0013",
        "S-0012",
        "S-0015",
        "S-1206",
        "S-1207",
        "S-1208",
        "S-1209",
        "S-1202",
        "S-1507"
      ],
      "next_level_gaps": [
        "Independent security evaluation of a deployed model-identity scheme that leaves no critical flaw open.",
        "Resistance of the enclave variant to physical attackers (see [[M-0008]]).",
        "Third-party verification for private models beyond consistency across requests.",
        "Tooling for audit-time checking of transparency records."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Underlying attestation can be forged or relayed",
        "kind": "demonstrated-attack",
        "severity": "critical",
        "status": "open",
        "description": "The enclave variant is only as sound as the attestation. With physical access and root privileges, TEE.fail extracted a per-CPU Intel attestation signing key and forged TDX attestations. Pairing the forgeries with genuine H100 attestations relayed from a rented server, the researchers made a workload outside TEE protection pass both checks [[S-1202]]. Other independent research forged AMD SEV-SNP attestations. Battering RAM did so with a DDR4 memory interposer, and RMPocalypse did so from a malicious hypervisor without physical access [[S-1210]] [[S-1212]]. AMD reports firmware fixes for RMPocalypse [[S-1213]]. Tinfoil's documentation lists physical attacks among the limitations of enclaves [[S-1206]].",
        "sources": [
          "S-1202",
          "S-1210",
          "S-1212",
          "S-1213",
          "S-1206"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Launch-state attestation does not by itself cover weights loaded later",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "mitigated",
        "description": "Attestation measures launch state, and weights are read from disk after boot. A signature checked at load time does not stop a malicious hypervisor from altering the disk afterwards [[S-0013]]. Tinfoil reports mitigating this with dm-verity checks on every read [[S-0013]]. Unmeasured runtime configuration remains a general risk [[S-0014]].",
        "sources": [
          "S-0013",
          "S-0014"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "For private models, a user can confirm consistency but not content",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "When weights are not published, users can check that the same root hash is served each time, but not what the model is [[S-0013]]. Pairing the hash with an attested evaluation, as in Attestable Audits, is one proposed remedy [[S-0009]].",
        "sources": [
          "S-0013",
          "S-0009"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Recomputation depends on trusted logging and randomness, and its tolerance leaves a covert channel",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "The recomputation variant assumes that every input, output and seed is logged correctly, and that the attacker can neither predict nor manipulate which messages are sampled for verification. Legitimate nondeterminism concentrates at a few token positions, and slow leaks within the tolerated slack remain possible [[S-0015]]. An independent study showed that an adversary who controls the prompts roughly doubles the bits leaked per token, reducing the exfiltration slowdown from more than 200 times to 60–118 times. The attack targets the exfiltration bound, not the check that outputs match the declared model [[S-1507]].",
        "sources": [
          "S-0015",
          "S-1507"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Attestation that resists physical attackers, for the enclave variant.",
        "theme": "hardware-trust",
        "blocked_by": "M-0008",
        "sources": [
          "S-1202"
        ]
      },
      {
        "text": "Numerical nondeterminism limits how tightly recomputation can pin down the model and sampling.",
        "theme": "protocol-soundness",
        "blocked_by": "M-0002",
        "sources": [
          "S-0015"
        ]
      },
      {
        "text": "The recomputation variant needs the verifier to hold the declared weights.",
        "theme": "access-governance",
        "blocked_by": null,
        "sources": [
          "S-0015"
        ]
      }
    ],
    "challenge_themes": [
      "evidence-binding",
      "hardware-trust",
      "protocol-soundness",
      "access-governance"
    ],
    "organizations": [
      "O-0141",
      "O-0142",
      "O-0202"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-0013",
        "supports": "Modelwrap design, launch-state problem, signing comparison, private models, overheads (provider-reported)",
        "locator": "sections on the challenge, the three phases, performance, private models"
      },
      {
        "source": "S-0012",
        "supports": "inference attestation binding hashes to TDX report; overheads",
        "locator": "§4, Table 6"
      },
      {
        "source": "S-0009",
        "supports": "audit-to-inference model-hash binding; prototype evaluation of the audit step",
        "locator": "§3, Algorithms 1-3, §5"
      },
      {
        "source": "S-0015",
        "supports": "recomputation-based verification, assumptions, results, limitations, code",
        "locator": "Abstract; §1, §3.3-3.4, §4.2, §5-§7"
      },
      {
        "source": "S-1507",
        "supports": "independent prompt-control attack that widens the exfiltration bound; 0.119 to 0.286 bits per token on the 30B MoE model",
        "locator": "Abstract; Table 1"
      },
      {
        "source": "S-0014",
        "supports": "measurement incompleteness; hashing-scheme warning"
      },
      {
        "source": "S-1202",
        "supports": "Intel TDX attestation forgery and H100 attestation relay to a vLLM proxy outside TEE protection",
        "locator": "Abstract; §1.1, §8.3"
      },
      {
        "source": "S-1210",
        "supports": "SEV-SNP attestation breach with a DDR4 interposer (Battering RAM)",
        "locator": "Abstract; site FAQ"
      },
      {
        "source": "S-1212",
        "supports": "software-only SEV-SNP attestation forgery by a malicious hypervisor (RMPocalypse)",
        "locator": "Abstract; site"
      },
      {
        "source": "S-1213",
        "supports": "AMD firmware fixes for RMPocalypse (vendor-reported)",
        "locator": "Mitigation tables"
      },
      {
        "source": "S-1206",
        "supports": "Tinfoil hardware, trust model and documented limitations (provider-reported)"
      },
      {
        "source": "S-1207",
        "supports": "measured boot chain, Sigstore publication, production model volumes (provider-reported)"
      },
      {
        "source": "S-1208",
        "supports": "production deployment; no supported audit-time tool (provider-reported)",
        "locator": "In-band vs. out-of-band verification"
      },
      {
        "source": "S-1209",
        "supports": "open-source implementation, release v0.3.0"
      }
    ],
    "concepts": [
      "K-0024",
      "K-0004",
      "K-0006",
      "K-0009",
      "K-0008",
      "K-0022",
      "K-0019"
    ],
    "complements": [
      "M-0002",
      "M-0023"
    ],
    "alternatives": [
      "M-0004"
    ],
    "type": "mechanism",
    "implementations": [
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/"
      }
    ],
    "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/",
    "source_file": "content/mechanisms/model-identity-attestation.md",
    "flags_all": [
      "provider-reported",
      "critical-flaw-open",
      "ai-drafted"
    ],
    "body_markdown": "## How it works\n\nTwo routes exist, and they can be combined.\n\n### Commit and attest\n\nThis route runs inside a TEE ([[M-0008]]). It closes a gap: attestation \"measures launch state, not runtime state\", while weights are read from disk after boot [[S-0013]]. Three designs bind the weights to the attestation:\n\n- **[[I-0006|Tinfoil's Modelwrap]]** packs the weights into a read-only image and computes a Merkle-tree root hash. It places that hash on the kernel command line, which the enclave measurement covers, and the kernel's dm-verity layer checks every block read against it [[S-0013]]. Clients compare the attestation's measurements with values that Tinfoil's build pipeline publishes to the Sigstore transparency log [[S-1207]]. For a public model, anyone can rebuild the image from the same Hugging Face commit and compare root hashes [[S-0013]].\n- **PAL\\*M** puts hashes of each operation's inputs, including the model, and of its outputs into the Intel TDX report, for single prompts and multi-turn sessions [[S-0012]].\n- **[[I-0007|Attestable Audits]]** records the model hash when an audit runs. At inference time it checks that the served model matches, then returns each response with an attestation that links model, prompt, output and audit result [[S-0009]].\n\n### Recompute and compare\n\nThis route uses [[M-0001|sampled recomputation]]. A verifier that holds the declared weights scores logged outputs by the likelihood that each token was sampled from that model under a known seed. The estimators allow for legitimate numerical nondeterminism [[S-0015]]. Rinberg et al. frame the check as a way to catch weights hidden steganographically in responses, and it also shows whether outputs are consistent with the declared model [[S-0015]]. Deterministic inference is covered in [[M-0002]].\n\n## What it establishes\nThe two routes establish different things:\n\n- **Commit and attest** can show that the bytes served match a commitment [[S-0013]].\n- **Recompute and compare** can show that logged outputs are consistent with the declared model's sampling procedure [[S-0015]].\n\nNeither shows:\n\n- **What a private model can do.** With unpublished weights, a user can confirm only that the same weights are served each time [[S-0013]]. An attested evaluation bound to the same hash can close part of that gap [[S-0009]].\n- **Everything else that shapes behaviour.** Tinfoil measures the firmware, kernel, initrd and a configuration file as well as the weights [[S-1207]]. Gloria Z warns that unmeasured runtime flags can undermine integrity [[S-0014]].\n- **Properties a weak hashing scheme leaves out.** Gloria Z also warns that a scheme that sequences values loosely, or checks the weights too early in loading, could let two models with significantly different properties share a hash \"without breaking the hash function itself\" [[S-0014]].\n\n## Threat model\nThe enclave route trusts the hardware vendor and treats the host software as hostile. Tinfoil states \"You trust the hardware manufacturer\", but not the hypervisor or host OS [[S-1206]]. PAL\\*M excludes side channels and physical attacks [[S-0012]].\n\nThe recomputation route assumes the following [[S-0015]]:\n\n- the verification code is trusted;\n- every input, output and seed is logged correctly;\n- the attacker can neither predict nor manipulate which messages are sampled for verification;\n- the verifier sees prompts and responses and holds the weights.\n\n## Evidence\n- **[[I-0006|Tinfoil]].** Modelwrap is published under an MIT license [[S-1209]]. Tinfoil reports a storage overhead of 0.8%, build times of up to 13 min 25 s for a 554 GB model, and slower cold loading but no inference slowdown [[S-0013]].\n- **PAL\\*M.** It reports inference attestation on an H100 across three models, with total observed overhead of 3.8–11.4% for multi-turn sessions and 45.5–66.4% for single prompts [[S-0012]].\n- **[[I-0007|Attestable Audits]].** Its protocol binds inference to the audited model hash. The reported evaluation covers the audit step, for a 4-bit Llama-3.1-8B on CPU-only AWS Nitro Enclaves [[S-0009]].\n- **Rinberg et al.** They tested Llama-3.1-8B, Llama-3.2-3B and two Qwen mixture-of-experts models, and publish their code. On the 30B model under benign prompt traffic, the detector cut exfiltratable information to under 0.5% at a false-positive rate under 0.01% [[S-0015]]. An independent study found that prompt control roughly doubles leakage per token [[S-1507]].\n\n## Limitations\n- **Inherited TEE attacks.** Using physical access, TEE.fail forged Intel TDX attestations and, by pairing them with relayed H100 attestations, passed a workload outside TEE protection [[S-1202]]. Battering RAM and RMPocalypse forged AMD SEV-SNP attestations, the second without physical access [[S-1210]] [[S-1212]]. Tinfoil's documentation acknowledges physical-access and side-channel risks [[S-1206]].\n- **Audit-time checking.** Tinfoil does not provide a supported tool for querying its transparency records at audit time [[S-1208]].\n- **Recomputation slack.** Nondeterminism concentrates at a few token positions, and very slow leaks remain possible [[S-0015]]. An adversary who controls prompts widens the leak [[S-1507]].\n- **Recomputation dependencies.** The check depends on complete and trusted logging, and on the verifier holding the weights [[S-0015]].",
    "body_text": "How it works Two routes exist, and they can be combined. Commit and attest This route runs inside a TEE (TEE remote attestation for AI workloads). It closes a gap: attestation \"measures launch state, not runtime state\", while weights are read from disk after boot [S-0013]. Three designs bind the weights to the attestation: - Tinfoil's Modelwrap packs the weights into a read-only image and computes a Merkle-tree root hash. It places that hash on the kernel command line, which the enclave measurement covers, and the kernel's dm-verity layer checks every block read against it [S-0013]. Clients compare the attestation's measurements with values that Tinfoil's build pipeline publishes to the Sigstore transparency log [S-1207]. For a public model, anyone can rebuild the image from the same Hugging Face commit and compare root hashes [S-0013]. - PALM puts hashes of each operation's inputs, including the model, and of its outputs into the Intel TDX report, for single prompts and multi-turn sessions [S-0012]. - Attestable Audits records the model hash when an audit runs. At inference time it checks that the served model matches, then returns each response with an attestation that links model, prompt, output and audit result [S-0009]. Recompute and compare This route uses sampled recomputation. A verifier that holds the declared weights scores logged outputs by the likelihood that each token was sampled from that model under a known seed. The estimators allow for legitimate numerical nondeterminism [S-0015]. Rinberg et al. frame the check as a way to catch weights hidden steganographically in responses, and it also shows whether outputs are consistent with the declared model [S-0015]. Deterministic inference is covered in Deterministic and bit-exact inference. What it establishes The two routes establish different things: - Commit and attest can show that the bytes served match a commitment [S-0013]. - Recompute and compare can show that logged outputs are consistent with the declared model's sampling procedure [S-0015]. Neither shows: - What a private model can do. With unpublished weights, a user can confirm only that the same weights are served each time [S-0013]. An attested evaluation bound to the same hash can close part of that gap [S-0009]. - Everything else that shapes behaviour. Tinfoil measures the firmware, kernel, initrd and a configuration file as well as the weights [S-1207]. Gloria Z warns that unmeasured runtime flags can undermine integrity [S-0014]. - Properties a weak hashing scheme leaves out. Gloria Z also warns that a scheme that sequences values loosely, or checks the weights too early in loading, could let two models with significantly different properties share a hash \"without breaking the hash function itself\" [S-0014]. Threat model The enclave route trusts the hardware vendor and treats the host software as hostile. Tinfoil states \"You trust the hardware manufacturer\", but not the hypervisor or host OS [S-1206]. PALM excludes side channels and physical attacks [S-0012]. The recomputation route assumes the following [S-0015]: - the verification code is trusted; - every input, output and seed is logged correctly; - the attacker can neither predict nor manipulate which messages are sampled for verification; - the verifier sees prompts and responses and holds the weights. Evidence - Tinfoil. Modelwrap is published under an MIT license [S-1209]. Tinfoil reports a storage overhead of 0.8%, build times of up to 13 min 25 s for a 554 GB model, and slower cold loading but no inference slowdown [S-0013]. - PALM. It reports inference attestation on an H100 across three models, with total observed overhead of 3.8–11.4% for multi-turn sessions and 45.5–66.4% for single prompts [S-0012]. - Attestable Audits. Its protocol binds inference to the audited model hash. The reported evaluation covers the audit step, for a 4-bit Llama-3.1-8B on CPU-only AWS Nitro Enclaves [S-0009]. - Rinberg et al. They tested Llama-3.1-8B, Llama-3.2-3B and two Qwen mixture-of-experts models, and publish their code. On the 30B model under benign prompt traffic, the detector cut exfiltratable information to under 0.5% at a false-positive rate under 0.01% [S-0015]. An independent study found that prompt control roughly doubles leakage per token [S-1507]. Limitations - Inherited TEE attacks. Using physical access, TEE.fail forged Intel TDX attestations and, by pairing them with relayed H100 attestations, passed a workload outside TEE protection [S-1202]. Battering RAM and RMPocalypse forged AMD SEV-SNP attestations, the second without physical access [S-1210] [S-1212]. Tinfoil's documentation acknowledges physical-access and side-channel risks [S-1206]. - Audit-time checking. Tinfoil does not provide a supported tool for querying its transparency records at audit time [S-1208]. - Recomputation slack. Nondeterminism concentrates at a few token positions, and very slow leaks remain possible [S-0015]. An adversary who controls prompts widens the leak [S-1507]. - Recomputation dependencies. The check depends on complete and trusted logging, and on the verifier holding the weights [S-0015].",
    "referenced_by": [
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/"
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/"
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "O-0141",
        "title": "Tinfoil",
        "url": "https://trustbutveri.fyi/organizations/tinfoil/"
      },
      {
        "id": "O-0142",
        "title": "University of Cambridge",
        "url": "https://trustbutveri.fyi/organizations/university-of-cambridge/"
      }
    ]
  }
}