{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "M-0021",
    "slug": "workload-classification-from-telemetry",
    "title": "Workload classification from telemetry and side channels",
    "aliases": [
      "Training detection from GPU telemetry",
      "Power-based workload identification",
      "Training-versus-inference classification"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Telling whether chips are training, serving or doing non-AI work from GPU counters or power draw, signals that do not read weights or data.",
    "summary": "Workload classification infers what a chip is doing, such as training a model, serving it or running non-AI code. It uses signals that do not read weights or data: software counters such as power and utilization, or power draw measured outside the chip. Two 2026 preprints report high accuracy on their own test sets: 98.2% from software counters across nine NVIDIA GPU models, and 97% from an external probe on one H200. In the hardest cases, evasion strategies the classifier had not seen cut detection to 43–87% and 48–88% respectively; an added rule raised the second to at least 98%. The main obstacle is trust in the signal: software counters are read by software the operator controls, so they can be forged unless hardware protects the reading. External probes avoid this but have been tested on one GPU. Results cover single machines, and no independent evaluation exists.",
    "technical": "- **NVML signals and corpus.** Rahman and Tajdari sample nine NVML signals at about 1 Hz: GPU and memory utilization, memory used, power, temperature, SM and memory clocks, and PCIe transmit and receive bandwidth [[S-0037]]. Their corpus has 1,404 runs of 162 workloads, about 117 GPU-hours, on 9 NVIDIA GPU models across the Ampere, Ada, Hopper and Blackwell generations, with 1 to 8 GPUs per configuration; 421 of the runs are evasion attempts [[S-0037]].\n- **NVML classifier.** A two-stage random forest, first ML versus non-ML and then training versus inference, classifies 30 s windows [[S-0037]]. Before adversarial hardening, five-fold cross-validation grouped by run (26,496 windows from 1,396 runs) gives 98.21% ± 0.84% accuracy, 97.39% precision, 98.90% recall and a 3.06% false-positive rate [[S-0037]].\n- **NVML evasion.** The 20 evasion strategy families fall into six classes: utilization manipulation, memory reduction, workload mimicry, training disguised as inference, multi-GPU evasion and white-box attacks [[S-0037]]. In the fifth round the evader had white-box access to the previous round's classifier. After hardening, strategies seen in training were detected 100% of the time and held-out white-box strategies 43–87% of the time [[S-0037]].\n- **External power probe.** Gargiulo and Kulp clamp a Rogowski current probe around the positive conductors of an NVIDIA H200 NVL's PCIe auxiliary power supply and digitize at a nominal 10 MHz in 5 s windows [[S-1412]]. Their released dataset has 930 genuine and 680 adversarial recordings over 17 open model families and 25 non-AI workloads [[S-1412]]. On genuine recordings of model families unseen in training, they report 97% accuracy and a macro-averaged F1 of 0.955 across training, inference and non-AI classes [[S-1412]].\n- **Power-probe evasion.** A detector hardened against evasion, with the tested strategy held out, caught training at least 99% of the time for three of four strategies. It caught diluted low-rank adaptation (LoRA) 48–88% of the time, rising to at least 98% with an added rule [[S-1412]]. The four strategies cost 28.1% to 69.3% of throughput [[S-1412]]. The authors state that these attacks are not a comprehensive evaluation against adversarial behaviour [[S-1412]].",
    "category": "remote-sensing",
    "secondary_categories": [
      "on-chip",
      "off-chip-devices"
    ],
    "verifies": [
      {
        "claim": "C-0004",
        "role": "primary",
        "note": "Classifies observed activity as training, inference or non-ML work."
      },
      {
        "claim": "C-0007",
        "role": "supporting",
        "note": "Can flag training on hardware declared for other uses; does not measure training size by itself."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "red-teamed",
    "hardware_requirement": "existing-features",
    "prover_cooperation": "partial",
    "confidentiality": "partial",
    "depends_on": [
      {
        "target": "M-0010",
        "note": "Classifiers that use software-read counters need a tamper-resistant, authenticated path for on-chip telemetry."
      }
    ],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2: two preprints publish end-to-end results on current GPUs against stated, iterated adversaries; nobody independent has evaluated them.\n\n- **R1** met: the claim, signals and threat model are publicly described [[S-0037]] [[S-1412]] [[S-0007]].\n- **R2** met: Rahman and Tajdari evaluate 9 current NVIDIA GPU models against 20 evasion strategy families over five rounds of monitor–evader iteration, with method and setup described in enough detail to repeat [[S-0037]]. They state that their workload source code is in the project repository, but the paper gives no link [[S-0037]]. Gargiulo and Kulp classify workloads on an H200 from externally measured power, test four evasion strategies and release their recordings as a dataset [[S-1412]].\n- **R3** not met: no party other than the developers is reported to rely on these classifiers for a verification decision, no production-grade system is available, and no independent adversarial evaluation has been published.\n\nConfidence is medium: both results come from single machines, and the location of Rahman and Tajdari's code is not given.",
      "evidence": [
        "S-0037",
        "S-1412"
      ],
      "next_level_gaps": [
        "An independent red-team or peer-reviewed security analysis.",
        "Reliance by a verifier other than the developers, or a production-grade, available system.",
        "Results at multi-node cluster scale and across hardware vendors.",
        "A tamper-resistant, authenticated telemetry path (see [[M-0010]]), or physical sensing validated across devices."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Software-read counters can be forged by a privileged operator",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Rahman and Tajdari state that without hardware-enabled guarantees, an adversary with software privilege can return forged counter values. Their results assume a tamper-resistant read path and an authenticated telemetry channel [[S-0037]]. Gargiulo and Kulp note that on-chip counters are read by software under the operator's control, so values could be reported without being measured, or replayed from an authorized workload while a hidden one runs [[S-1412]]. Against an operator who controls the full stack, forgery defeats classification from software counters, the signal source that [[M-0010]] covers. It does not affect the external-probe route, which Gargiulo and Kulp argue can in principle be observed without the operator's cooperation [[S-1412]].",
        "sources": [
          "S-0037",
          "S-1412"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Unseen evasion strategies still reduce detection",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "Rahman and Tajdari gave the evader white-box access to the previous round's classifier in their fifth round. After hardening against the other strategies of that round, their classifier detected the held-out white-box strategies only 43–87% of the time, against 100% for strategies it had been trained on [[S-0037]]. In Gargiulo and Kulp's power-trace study, a hardened detector that had not seen diluted LoRA caught it 48–88% of the time. An added rule raised detection to at least 98%, and the strategy cost the evader 33.8–69.3% of throughput [[S-1412]].",
        "sources": [
          "S-0037",
          "S-1412"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "The training-inference boundary may blur",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Ansari argues that as inference-time compute scaling and fine-tuning become more capable, the training-inference distinction may cease to be a reliable governance boundary [[S-0007]].",
        "sources": [
          "S-0007"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Limited scale and hardware coverage",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "Rahman and Tajdari's experiments are single-node, with up to 8 GPUs, and cover NVIDIA hardware only [[S-0037]]. Gargiulo and Kulp's corpus was collected on a single H200 NVL, and generalization across devices remains to be established [[S-1412]].",
        "sources": [
          "S-0037",
          "S-1412"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Software telemetry is trustworthy only if on-chip counters are read over a path the operator cannot tamper with.",
        "theme": "hardware-trust",
        "blocked_by": "M-0010",
        "sources": [
          "S-0037",
          "S-1412"
        ]
      },
      {
        "text": "No independent red-team or third-party reliance has been reported.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-0037",
          "S-1412"
        ]
      },
      {
        "text": "Results do not yet cover multi-node clusters, other vendors or multi-tenant serving.",
        "theme": "coverage-hidden-compute",
        "blocked_by": null,
        "sources": [
          "S-0037",
          "S-1412"
        ]
      }
    ],
    "challenge_themes": [
      "hardware-trust",
      "adversarial-validation",
      "coverage-hidden-compute",
      "evidence-binding"
    ],
    "organizations": [
      "O-0101"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-0037",
        "supports": "NVML-based classifier, corpus, cross-validated accuracy, evasion families and rounds, hardened detection of unseen strategies, threat model, trust assumption, code statement, limitations",
        "locator": "Abstract; §2.1, §2.2, §4.1-4.3, §5.1-5.2 and Table 5, §6.5; App. F"
      },
      {
        "source": "S-1412",
        "supports": "external power-probe classifier, accuracy on unseen model families, evasion strategies, hardened detection and costs, dataset release, NVML spoofing argument, limitations",
        "locator": "Abstract; §2-4; limitations"
      },
      {
        "source": "S-0007",
        "supports": "workload-classification and power-monitoring feasibility; training-inference boundary",
        "locator": "§3.1 (M2, M4); §4.6"
      },
      {
        "source": "S-0048",
        "supports": "power delivery hierarchy filters signals; low-level monitoring harder to spoof",
        "locator": "whole note"
      },
      {
        "source": "S-0041",
        "supports": "measured training power of an 8-GPU H100 node",
        "locator": "Abstract"
      },
      {
        "source": "S-0042",
        "supports": "input data changes GEMM power draw",
        "locator": "Abstract"
      },
      {
        "source": "S-0040",
        "supports": "precedent: counter-based detection of covert cryptomining",
        "locator": "Abstract; evaluation"
      },
      {
        "source": "S-0039",
        "supports": "precedent: operator-accessible hardware signals for workload-agnostic anomaly detection",
        "locator": "Abstract; §3, §4.1"
      },
      {
        "source": "S-0046",
        "supports": "power traces can leak model architecture",
        "locator": "Abstract"
      },
      {
        "source": "S-0073",
        "supports": "nvidia-smi power readings (via NVML) sample only 25% of runtime on A100 and H100; error about ±5% versus NVIDIA's claimed ±5 W",
        "locator": "Abstract; accuracy findings"
      }
    ],
    "concepts": [
      "K-0025",
      "K-0013",
      "K-0007",
      "K-0018"
    ],
    "complements": [
      "M-0013",
      "M-0020"
    ],
    "alternatives": [],
    "type": "mechanism",
    "implementations": [],
    "url": "https://trustbutveri.fyi/mechanisms/workload-classification-from-telemetry/",
    "source_file": "content/mechanisms/workload-classification-from-telemetry.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "## How it works\n\nWorkload classification infers what a chip is doing from signals that do not reveal the content of the computation [[S-0037]] [[S-1412]]. Typical labels are training, inference and non-AI work [[S-0037]] [[S-1412]]. Ansari lists it among monitoring mechanisms [[S-0007]]. It uses cluster-level signals such as power and network bandwidth, and node-level signals such as accelerator utilization and memory bandwidth [[S-0007]].\n\nThere are two main signal sources:\n\n- **Software telemetry.** Rahman and Tajdari use NVIDIA's NVML counters, including utilization, memory, power, temperature, clocks and PCIe traffic, sampled about once a second [[S-0037]]. They describe these as zero-overhead, content-agnostic signals that do not access weights, data or hyperparameters [[S-0037]]. A random-forest pipeline first separates ML from non-ML work, then training from inference [[S-0037]].\n- **Physical side channels.** Gargiulo and Kulp clamp a current probe on a GPU's auxiliary power supply and classify five-second power recordings sampled at 10 MHz [[S-1412]]. They argue that, unlike NVML telemetry, this channel can in principle be observed without the operator's cooperation [[S-1412]].\n\nWhere power is measured matters [[S-0048]]. Amodo Design describes each stage of data-centre power delivery, from the voltage regulator to the grid, as a low-pass filter: the further up the chain one measures, the less compute-level detail survives [[S-0048]]. Amodo argues that low-level power monitoring could be more expensive to spoof [[S-0048]].\n\nSimilar methods have precedents outside AI governance [[S-0040]] [[S-0039]]. Gangwal et al. detected covert cryptocurrency mining from CPU hardware performance counters with 99.9–100% binary accuracy on two test systems [[S-0040]]. Chen et al.'s Reveal detects system anomalies in ML clusters from hardware signals that operators can read, without knowledge of user workloads [[S-0039]].\n\n## What it establishes\nThe authors report that, on the hardware tested, classifiers separate training from inference and non-ML work with high accuracy [[S-0037]] [[S-1412]]. Rahman and Tajdari report 98.2% across their own corpus of NVML telemetry [[S-0037]]. Gargiulo and Kulp report 97% from external power traces on one H200, for model families unseen in training [[S-1412]]. Both figures fall for evasion strategies the classifier has not seen (see Evidence to date). The results support checks that hardware declared for inference or non-AI use is not training ([[C-0004]]) [[S-0037]] [[S-1412]].\n\nWhat it cannot show:\n\n- **How much training, or of what.** The papers classify workload type only, not how much training occurred or which model was trained [[S-0037]] [[S-1412]].\n- **AI training versus other heavy computing, from power alone.** Ansari's April 2026 feasibility taxonomy noted that power monitoring alone cannot separate AI training from other high-performance computing without other signals, and that no published study had quantified false-positive rates for power-based training detection [[S-0007]].\n- **Workload type from power level alone.** Power draw depends on more than workload type: Gregersen et al. found that changing only the input data can alter GPU power in matrix multiplication by nearly 40% [[S-0042]]. Measured draw can also differ from rated power: Latif et al. recorded a peak of about 8.4 kW on an 8-GPU H100 node during training, 18% below its rated 10.2 kW, with GPUs near full utilization [[S-0041]].\n\nThe signals can also reveal more than the workload class. Gao et al. recovered the architectures of models running on general-purpose processors from software-read power measurements, with 99.75% accuracy by their Levenshtein-distance measure [[S-0046]].\n\n## Threat model\nRahman and Tajdari consider two evaders [[S-0037]]:\n\n- **A cloud tenant** who controls only user-space software.\n- **A hardware operator** who controls the full stack and wants to hide unauthorized training from a regulator.\n\nTheir results depend on a tamper-resistant NVML read path and an authenticated telemetry channel, which they treat as minimum hardware-enabled guarantees ([[M-0010]]) [[S-0037]]. In their fifth round they give the evader white-box access to the classifier, which they describe as a disaster scenario for governance [[S-0037]]. Gargiulo and Kulp treat the operator as adversarial and able to reshape the computation, but not able to control the external probe [[S-1412]].\n\n## Evidence\n- **Software telemetry.** Rahman and Tajdari ran five rounds of monitor–evader iteration over 20 evasion strategy families on 9 GPU models spanning four architecture generations [[S-0037]]. They report 98.2% accuracy across their corpus [[S-0037]]. After hardening, strategies seen in training were always detected, but white-box strategies held out from training were detected only 43–87% of the time [[S-0037]].\n- **External power.** Gargiulo and Kulp report 97% accuracy on held-out model families from a probe on one H200 NVL [[S-1412]]. Their hardened detector caught three of four held-out evasion strategies at least 99% of the time, and diluted LoRA 48–88% of the time, or at least 98% with an added rule [[S-1412]]. They release their 1,610 recordings and state that their attacks are not a comprehensive adversarial evaluation [[S-1412]].\n- **Earlier assessment.** Before these papers, Ansari rated workload classification as deployable in cooperative settings and near-term in adversarial settings [[S-0007]].\n\n## Limitations\n- **Forged or replayed telemetry.** A privileged operator can forge or replay software-read counters unless hardware protects the read path [[S-0037]] [[S-1412]].\n- **Unseen evasion strategies.** Detection falls to 43–87% for held-out white-box strategies on NVML telemetry [[S-0037]], and to 48–88% for diluted LoRA on external power before an added rule [[S-1412]]. In Gargiulo and Kulp's tests the evasion strategies cost 28.1–69.3% of throughput [[S-1412]].\n- **Scale.** Results are single-node and NVIDIA-only [[S-0037]], or from one H200 [[S-1412]].\n- **Power sampling.** Yang and colleagues found that on A100 and H100 GPUs the built-in power reading, which nvidia-smi obtains through NVML, samples only 25% of runtime. The GPU can draw very different power in the other 75% without the reading showing it [[S-0073]]. They also found the reading's error to be within about ±5% in most cases, against the ±5 W that NVIDIA claims [[S-0073]].\n- **Distributed training.** Ansari reports that classification accuracy degrades when training is distributed across providers [[S-0007]].\n- **Blurring categories.** The training-inference distinction may lose governance value [[S-0007]].\n- **Spoofed power monitoring.** Amodo expects that power monitoring can likely be spoofed, but still sees value in it as a complement to other verification systems [[S-0048]].",
    "body_text": "How it works Workload classification infers what a chip is doing from signals that do not reveal the content of the computation [S-0037] [S-1412]. Typical labels are training, inference and non-AI work [S-0037] [S-1412]. Ansari lists it among monitoring mechanisms [S-0007]. It uses cluster-level signals such as power and network bandwidth, and node-level signals such as accelerator utilization and memory bandwidth [S-0007]. There are two main signal sources: - Software telemetry. Rahman and Tajdari use NVIDIA's NVML counters, including utilization, memory, power, temperature, clocks and PCIe traffic, sampled about once a second [S-0037]. They describe these as zero-overhead, content-agnostic signals that do not access weights, data or hyperparameters [S-0037]. A random-forest pipeline first separates ML from non-ML work, then training from inference [S-0037]. - Physical side channels. Gargiulo and Kulp clamp a current probe on a GPU's auxiliary power supply and classify five-second power recordings sampled at 10 MHz [S-1412]. They argue that, unlike NVML telemetry, this channel can in principle be observed without the operator's cooperation [S-1412]. Where power is measured matters [S-0048]. Amodo Design describes each stage of data-centre power delivery, from the voltage regulator to the grid, as a low-pass filter: the further up the chain one measures, the less compute-level detail survives [S-0048]. Amodo argues that low-level power monitoring could be more expensive to spoof [S-0048]. Similar methods have precedents outside AI governance [S-0040] [S-0039]. Gangwal et al. detected covert cryptocurrency mining from CPU hardware performance counters with 99.9–100% binary accuracy on two test systems [S-0040]. Chen et al.'s Reveal detects system anomalies in ML clusters from hardware signals that operators can read, without knowledge of user workloads [S-0039]. What it establishes The authors report that, on the hardware tested, classifiers separate training from inference and non-ML work with high accuracy [S-0037] [S-1412]. Rahman and Tajdari report 98.2% across their own corpus of NVML telemetry [S-0037]. Gargiulo and Kulp report 97% from external power traces on one H200, for model families unseen in training [S-1412]. Both figures fall for evasion strategies the classifier has not seen (see Evidence to date). The results support checks that hardware declared for inference or non-AI use is not training (This compute runs inference, not training) [S-0037] [S-1412]. What it cannot show: - How much training, or of what. The papers classify workload type only, not how much training occurred or which model was trained [S-0037] [S-1412]. - AI training versus other heavy computing, from power alone. Ansari's April 2026 feasibility taxonomy noted that power monitoring alone cannot separate AI training from other high-performance computing without other signals, and that no published study had quantified false-positive rates for power-based training detection [S-0007]. - Workload type from power level alone. Power draw depends on more than workload type: Gregersen et al. found that changing only the input data can alter GPU power in matrix multiplication by nearly 40% [S-0042]. Measured draw can also differ from rated power: Latif et al. recorded a peak of about 8.4 kW on an 8-GPU H100 node during training, 18% below its rated 10.2 kW, with GPUs near full utilization [S-0041]. The signals can also reveal more than the workload class. Gao et al. recovered the architectures of models running on general-purpose processors from software-read power measurements, with 99.75% accuracy by their Levenshtein-distance measure [S-0046]. Threat model Rahman and Tajdari consider two evaders [S-0037]: - A cloud tenant who controls only user-space software. - A hardware operator who controls the full stack and wants to hide unauthorized training from a regulator. Their results depend on a tamper-resistant NVML read path and an authenticated telemetry channel, which they treat as minimum hardware-enabled guarantees (On-chip telemetry from timing, memory and performance counters) [S-0037]. In their fifth round they give the evader white-box access to the classifier, which they describe as a disaster scenario for governance [S-0037]. Gargiulo and Kulp treat the operator as adversarial and able to reshape the computation, but not able to control the external probe [S-1412]. Evidence - Software telemetry. Rahman and Tajdari ran five rounds of monitor–evader iteration over 20 evasion strategy families on 9 GPU models spanning four architecture generations [S-0037]. They report 98.2% accuracy across their corpus [S-0037]. After hardening, strategies seen in training were always detected, but white-box strategies held out from training were detected only 43–87% of the time [S-0037]. - External power. Gargiulo and Kulp report 97% accuracy on held-out model families from a probe on one H200 NVL [S-1412]. Their hardened detector caught three of four held-out evasion strategies at least 99% of the time, and diluted LoRA 48–88% of the time, or at least 98% with an added rule [S-1412]. They release their 1,610 recordings and state that their attacks are not a comprehensive adversarial evaluation [S-1412]. - Earlier assessment. Before these papers, Ansari rated workload classification as deployable in cooperative settings and near-term in adversarial settings [S-0007]. Limitations - Forged or replayed telemetry. A privileged operator can forge or replay software-read counters unless hardware protects the read path [S-0037] [S-1412]. - Unseen evasion strategies. Detection falls to 43–87% for held-out white-box strategies on NVML telemetry [S-0037], and to 48–88% for diluted LoRA on external power before an added rule [S-1412]. In Gargiulo and Kulp's tests the evasion strategies cost 28.1–69.3% of throughput [S-1412]. - Scale. Results are single-node and NVIDIA-only [S-0037], or from one H200 [S-1412]. - Power sampling. Yang and colleagues found that on A100 and H100 GPUs the built-in power reading, which nvidia-smi obtains through NVML, samples only 25% of runtime. The GPU can draw very different power in the other 75% without the reading showing it [S-0073]. They also found the reading's error to be within about ±5% in most cases, against the ±5 W that NVIDIA claims [S-0073]. - Distributed training. Ansari reports that classification accuracy degrades when training is distributed across providers [S-0007]. - Blurring categories. The training-inference distinction may lose governance value [S-0007]. - Spoofed power monitoring. Amodo expects that power monitoring can likely be spoofed, but still sees value in it as a complement to other verification systems [S-0048].",
    "referenced_by": [
      {
        "id": "M-0010",
        "title": "On-chip telemetry from timing, memory and performance counters",
        "url": "https://trustbutveri.fyi/mechanisms/on-chip-telemetry/"
      },
      {
        "id": "M-0020",
        "title": "Remote detection of data centres",
        "url": "https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "C-0004",
        "title": "This compute runs inference, not training",
        "url": "https://trustbutveri.fyi/claims/inference-not-training/"
      },
      {
        "id": "K-0025",
        "title": "Inference and training workloads",
        "url": "https://trustbutveri.fyi/concepts/inference-and-training-workloads/"
      },
      {
        "id": "K-0013",
        "title": "Side channel",
        "url": "https://trustbutveri.fyi/concepts/side-channel/"
      },
      {
        "id": "O-0101",
        "title": "Amodo Design",
        "url": "https://trustbutveri.fyi/organizations/amodo-design/"
      },
      {
        "id": "O-0203",
        "title": "Verifiable Compute Foundation",
        "url": "https://trustbutveri.fyi/organizations/verifiable-compute-foundation/"
      }
    ]
  }
}