{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "M-0025",
    "slug": "confidential-multi-party-verification",
    "title": "Confidential multi-party verification",
    "aliases": [
      "Confidential audits",
      "Attested confidential workflows",
      "Trustless audits"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [],
    "one_liner": "Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.",
    "summary": "Many verification questions involve assets that their owners will not show anyone, such as a developer's model weights, an auditor's test data or users' logs. Confidential multi-party verification runs the agreed check where no participant can see the others' inputs, either inside hardware-isolated enclaves that sign what code ran or with zero-knowledge proofs. Only the result is released, with evidence of how it was produced. Research prototypes compose multi-step audit workflows on commercial enclaves, run safety benchmarks without revealing the model or test data, limit usage monitoring to a jointly signed plan, and prove audits of small models with zero-knowledge proofs. As of September 2026 none is documented as relied on for a verification decision, and none has been independently red-teamed. The main obstacles are the limited scale of enclaves and proof systems, and trust in hardware vendors. Even a one-bit verdict can leak information about the private inputs.",
    "technical": "- **Cove object model.** An artifact is a unit of private data with exactly one owner, encrypted locally before upload. A workflow is a directed acyclic graph with a canonical serialization, and its hash names the bundle. Compilation to per-node manifests is deterministic, and the manifest hash is the node's identity. Owners record allow rules that bind each artifact to approved manifest hashes [[S-1505]].\n- **Cove run and verification.** At run time a node fetches and verifies upstream certificates, evaluates preconditions, obtains decryption keys only after attestation, runs the workload and emits a certificate whose TEE report data commits to the certificate-body hash. Report data is two SHA-256 hashes, of a fixed label and of a canonical payload. Verifiers start from a terminal certificate, the workflow bytes and the TEE vendor's roots, and check each certificate recursively [[S-1505]].\n- **ZkAudit.** The provider publishes commitments to its dataset and weights, with a zero-knowledge proof that the committed weights result from training. It then answers each audit request by computing a function F privately and releasing F's output with a second proof [[S-0022]]. A copyright or demographic audit of a MobileNet v2 model on Flowers-102 cost $108 in total (about 10 cents per image), and a counterfactual audit of a recommender on MovieLens cost $8,456 [[S-0022]].\n- **Minimal Information Disclosure.** It chooses the evidence mechanism to minimize the conditional mutual information between protected properties and the released evidence, subject to a floor on information about the authorized target. One variant proves a linear projection with a Groth16 zk-SNARK [[S-1506]].",
    "category": "cryptographic-computational",
    "secondary_categories": [
      "on-chip"
    ],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Binds audit or capability-evaluation results to the model that is served, without revealing weights (S-0009, S-0011)."
      },
      {
        "claim": "C-0006",
        "role": "supporting",
        "note": "Plan-scoped monitoring runs an agreed classifier over private usage records (S-1503)."
      },
      {
        "claim": "C-0007",
        "role": "supporting",
        "note": "Zero-knowledge audits can prove properties of committed training data and weights (S-0022)."
      }
    ],
    "threat_model": "semi-trusted",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "existing-features",
    "prover_cooperation": "required",
    "confidentiality": "preserving",
    "depends_on": [
      {
        "target": "M-0008",
        "note": "TEE-based designs rely on measured launch and remote attestation."
      }
    ],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2: open-source and peer-reviewed prototypes work on production enclaves and small models, but none is relied on or independently evaluated.\n\n- **R1** met: designs that state what is verified and what is trusted are published for TEE workflows [[S-0011]] [[S-1505]] and zero-knowledge audits [[S-0022]].\n- **R2** met. Cove has an open-source reference implementation on Intel TDX via Phala Cloud's dstack, and its authors report an end-to-end attested confidential benchmark workflow on that production enclave platform [[S-0011]] [[S-1505]]. ZkAudit reports peer-reviewed end-to-end audits of MobileNet image classifiers and a recommender model [[S-0022]]. [[I-0007|Attestable Audits]] ran safety benchmarks on an 8-billion-parameter model in AWS Nitro Enclaves [[S-0009]].\n- **R3** not met. Criterion (a) fails: no party other than a developer is documented as relying on these systems for a verification decision, and they are research prototypes. Criterion (b) fails: no independent audit or red-team of Cove, Attestable Audits or ZkAudit has been published. An independent analysis of one monitoring tool's published evaluation found that its one-bit verdicts leak information [[S-1506]].\n\nConfidence is medium: prototypes exist, but at small model scales or on CPU-only enclaves [[S-0009]] [[S-0022]].",
      "evidence": [
        "S-0011",
        "S-1505",
        "S-0022",
        "S-0009",
        "S-1506"
      ],
      "next_level_gaps": [
        "Reliance by a party other than the developer on a confidential multi-party workflow for a verification decision, or a production-grade system that is generally available.",
        "An independent security evaluation (audit, red-team or peer-reviewed analysis) of a workflow system such as Cove.",
        "Demonstration with frontier-scale models on GPU enclaves or with zero-knowledge proofs at that scale."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Released verdicts can leak information about private inputs",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "Even a one-bit result can reveal more than intended. Abdelghafar and Kulp used the published evaluation of Auditor-in-a-Box, whose output filter is meant to disclose at most one bit. Given only the valid or invalid decision on a new request, a simple predictor identified which of two request sets it came from (borderline or proxy requests versus ordinary research requests) with 72.4% balanced accuracy, against 50% without the decision. In a second experiment, which distinguished reinforcement-learning workloads from others, several candidate one-bit reports revealed exact-workload information.",
        "sources": [
          "S-1506"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Memory-bus interposition extracts attestation keys and forges attestations",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "With physical access to a server's DDR5 memory bus, researchers extracted a per-CPU Intel attestation provisioning key and forged TDX attestations. Against AMD SEV-SNP the same attack recovered a signing key used inside the virtual machine, not an AMD attestation key. Other attacks have forged SEV-SNP attestation: Battering RAM with an interposer on DDR4 servers, and RMPocalypse from a malicious hypervisor until AMD's firmware fix. By pairing forged TDX attestations with genuine H100 attestations relayed from rented hardware, they made a workload without TEE protection appear to run under GPU confidential computing. Intel, AMD and NVIDIA acknowledged the findings. Cove's reference implementation trusts Intel TDX attestation roots.",
        "sources": [
          "S-1202",
          "S-1210",
          "S-1212",
          "S-1213",
          "S-1505"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Guarantees depend on the host software stack and on review",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Cove's developers state that compromise of the Docker daemon, host kernel or TEE stack breaks all guarantees. They also state that Docker policy alone cannot prove that guest code cannot generate a quote if the platform exposes quote instructions globally, and that compiled workflow bundles are hashed and reviewable but not signed by a publisher key.",
        "sources": [
          "S-1505"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Completeness is not established",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "A confidential workflow proves facts about the records and models submitted to it. A governance analysis notes that an auditor also needs assurance that all activity is accounted for, since a host could start a second confidential virtual machine that uses a different model or bypasses monitoring.",
        "sources": [
          "S-0014"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Zero-knowledge audits reveal model architecture",
        "kind": "theoretical-argument",
        "severity": "minor",
        "status": "open",
        "description": "ZkAudit keeps weights and data secret but reveals the model architecture, and it does not protect against data poisoning.",
        "sources": [
          "S-0022"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "GPU confidential computing is less mature than CPU support and frontier inference typically needs the resources of several GPUs; a CPU-only enclave audit prototype ran at 1.84 tokens per second.",
        "theme": "performance-compatibility",
        "blocked_by": "M-0008",
        "sources": [
          "S-0014",
          "S-0009"
        ]
      },
      {
        "text": "Zero-knowledge audits have been shown on image classifiers and a recommender model, not language models at frontier scale, and a counterfactual audit of the recommender cost $8,456.",
        "theme": "performance-compatibility",
        "blocked_by": "M-0004",
        "sources": [
          "S-0022"
        ]
      },
      {
        "text": "Trust rests on a small number of hardware vendors, and a per-CPU Intel attestation key has been extracted by physical attack.",
        "theme": "hardware-trust",
        "blocked_by": "M-0008",
        "sources": [
          "S-0014",
          "S-1202"
        ]
      },
      {
        "text": "Parties must negotiate the plan or workflow and handle false positives and appeals, which the Auditor-in-a-Box authors list as open problems.",
        "theme": "access-governance",
        "blocked_by": null,
        "sources": [
          "S-1504"
        ]
      },
      {
        "text": "Released evidence must be designed to limit collateral leakage, which requires declaring protected properties in advance and calibrating on labelled executions.",
        "theme": "privacy-leakage",
        "blocked_by": null,
        "sources": [
          "S-1506"
        ]
      }
    ],
    "challenge_themes": [
      "privacy-leakage",
      "hardware-trust",
      "performance-compatibility",
      "access-governance",
      "coverage-hidden-compute"
    ],
    "organizations": [
      "O-0142",
      "O-0202"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-0011",
        "supports": "problem statement; framework; three applications; open-source implementation on Intel TDX via dstack",
        "locator": "abstract (read via the ICML 2026 virtual poster page; the OpenReview PDF was not reachable)"
      },
      {
        "source": "S-1505",
        "supports": "object model; lifecycle; certificates; trust boundary; residual risks",
        "locator": "README; docs/internal/architecture.md; docs/internal/security_model.md"
      },
      {
        "source": "S-0022",
        "supports": "ZkAudit protocol; models and datasets; accuracy; costs; assumptions; architecture disclosure; data poisoning",
        "locator": "abstract; §5; Tables 1-4; limitations"
      },
      {
        "source": "S-0009",
        "supports": "multi-party enclave audit protocol; transparency log; prototype and throughput; CPU versus GPU cost and slowdown; vendor trust",
        "locator": "§3; §4; §5; Table 2"
      },
      {
        "source": "S-1503",
        "supports": "plan-scoped monitoring protocol",
        "locator": "abstract"
      },
      {
        "source": "S-1504",
        "supports": "plan definition; reference implementation; process problems; limitations",
        "locator": "whole post"
      },
      {
        "source": "S-1506",
        "supports": "minimal information disclosure framework; one-bit leakage findings; Groth16 variant; limitations",
        "locator": "abstract; introduction; Appendix A; Figure 5; limitations"
      },
      {
        "source": "S-0014",
        "supports": "completeness and second-CVM gap; vendor root of trust; GPU TEE maturity; multi-GPU inference; treaty threat model",
        "locator": "resource accounting; hardware auditability; physical attack surface"
      },
      {
        "source": "S-1202",
        "supports": "physical extraction of Intel attestation keys and SEV-SNP signing keys; forged attestations against NVIDIA GPU confidential computing; vendor acknowledgement",
        "locator": "project site summary; paper abstract and disclosure"
      },
      {
        "source": "S-1210",
        "supports": "Battering RAM forges SEV-SNP attestation with a DDR4 interposer"
      },
      {
        "source": "S-1212",
        "supports": "RMPocalypse forges SEV-SNP attestation from a malicious hypervisor"
      },
      {
        "source": "S-1213",
        "supports": "AMD firmware fixes for RMPocalypse (CVE-2025-0033)"
      }
    ],
    "concepts": [
      "K-0001",
      "K-0002",
      "K-0004",
      "K-0005",
      "K-0006",
      "K-0010",
      "K-0018",
      "K-0024"
    ],
    "complements": [
      "M-0023",
      "M-0012"
    ],
    "alternatives": [],
    "type": "mechanism",
    "implementations": [],
    "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/",
    "source_file": "content/mechanisms/confidential-multi-party-verification.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "## How it works\n\nAudits often need sensitive artifacts, such as model weights and evaluation data, held by parties who do not trust each other [[S-0011]]. Model providers have business reasons to keep models and data secret, while society needs algorithmic transparency [[S-0022]]. Confidential multi-party verification moves the agreed check to a place where no single party sees the others' inputs [[S-0011]] [[S-0022]].\n\n- **Composable enclave workflows.** Cove uses trusted execution environments (TEEs) to compose reusable multi-stage audit workflows [[S-0011]]. In its developers' design, each data owner encrypts its artifact locally and approves only specific, hashed workflow steps [[S-1505]]. A key is released only to an enclave whose attestation matches an approved step [[S-1505]]. Each step emits a certificate that the hardware binds to its code and outputs, and a verifier checks the whole chain, starting from the final certificate [[S-1505]].\n- **Enclave-run audits.** In [[I-0007|Attestable Audits]], the model provider and the auditor each encrypt their inputs to an enclave key [[S-0009]]. The enclave runs the benchmark and publishes to a transparency log an attestation that binds the model hash, the hash of the audit code and data, and the result [[S-0009]].\n- **Plan-scoped monitoring.** A monitoring party and a monitored party co-sign a plan, which an open-source classifier runs inside an attested TEE; scope changes need fresh signatures from both parties [[S-1503]]. The plan fixes the inputs, the computation steps and the outputs to be released [[S-1504]].\n- **Zero-knowledge audits.** In ZkAudit, a provider publishes cryptographic commitments to its dataset and weights, plus a zero-knowledge proof that the weights came from training on that data [[S-0022]]. It then answers audit requests by computing a function privately and releasing the output with a proof that the computation was correct [[S-0022]].\n- **Designing what is disclosed.** Minimal Information Disclosure treats the content of the released evidence as a design choice, and aims to minimize what the evidence reveals beyond the authorized result [[S-1506]].\n\n## What it establishes\nIt can establish:\n\n- that an agreed computation ran on committed or attested inputs and produced the released result, without revealing the inputs [[S-0022]] [[S-1505]];\n- in Attestable Audits, that the model answering a user is the one that was audited [[S-0009]].\n\nIt cannot establish:\n\n- that nothing was left out of the workflow, since auditors also need assurance that all activity is accounted for [[S-0014]];\n- that the released result reveals nothing else: in one analysis, a one-bit verdict let a predictor tell which of two groups a private request came from with 72.4% balanced accuracy, against 50% by chance [[S-1506]];\n- in ZkAudit, secrecy of the model architecture, which the proofs reveal [[S-0022]].\n\n## Threat model\n- **Cove.** Its developers state that it trusts Intel TDX and its attestation roots, Docker's enforcement of the generated configuration, pinned first-party components, and public source code with human review [[S-1505]]. It does not trust its own storage server, network routing or orchestration [[S-1505]].\n- **Attestable Audits.** All parties must trust the vendor of the confidential-computing technology, which was AWS in the prototype [[S-0009]].\n- **ZkAudit.** It rests on cryptographic assumptions, including binding and hiding commitments [[S-0022]].\n- **Treaty setting.** A governance analysis contrasts the confidential-computing adversary, a dishonest operator, with the adversary in a treaty setting: a state with physical access to data centres and leverage over hardware vendors [[S-0014]].\n\n## Evidence\n- **Cove.** Its authors show how its primitives express three applications: capability-attested inference, attested confidential benchmarks and bilateral capability verification [[S-0011]]. They report an open-source reference implementation on Intel TDX via Phala Cloud's dstack, demonstrated end to end on the benchmark workflow only [[S-0011]] [[S-1505]].\n- **Attestable Audits.** The authors ran MMLU, XSum and ToxicChat on a 4-bit Llama-3.1-8B model in CPU-only AWS Nitro Enclaves [[S-0009]]. They report that CPU inference cost 21.7 times as much per token as GPU inference and ran about 100 times slower [[S-0009]].\n- **ZkAudit.** Peer-reviewed at ICML 2024 [[S-0022]]. The authors audited MobileNet v2 image classifiers on three datasets, with accuracy 0.5–0.7 percentage points below full precision, and a small recommender whose error matched full precision [[S-0022]].\n- **Auditor-in-a-Box.** A reference implementation runs in Tinfoil confidential virtual machines [[S-1504]]. Its authors state that user data and plan execution in the demo are not actually secure, and that it has not been stress-tested by a counterparty [[S-1504]].\n\n## Limitations\n- **Verdict leakage.** Abdelghafar and Kulp found that one-bit reports can reveal sensitive attributes [[S-1506]]. They propose designing the evidence itself to limit this [[S-1506]].\n- **Physical attacks on TEEs.** Researchers interposing on the memory bus extracted a per-CPU Intel attestation key and forged TDX attestations [[S-1202]]. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone before AMD's fix [[S-1210]] [[S-1212]].\n- **Stack trust.** Compromise of the Docker daemon, host kernel or TEE stack breaks Cove's guarantees [[S-1505]].\n- **Scale.** Frontier model inference typically needs the resources of several GPUs [[S-0014]], and ZkAudit was shown on image classifiers and a recommender model, not frontier-scale language models [[S-0022]].\n- **Process.** Plan negotiation, false positives and appeals remain open problems [[S-1504]].\n\nFor attesting that a declared safeguard ran on a single service, see [[M-0023]].",
    "body_text": "How it works Audits often need sensitive artifacts, such as model weights and evaluation data, held by parties who do not trust each other [S-0011]. Model providers have business reasons to keep models and data secret, while society needs algorithmic transparency [S-0022]. Confidential multi-party verification moves the agreed check to a place where no single party sees the others' inputs [S-0011] [S-0022]. - Composable enclave workflows. Cove uses trusted execution environments (TEEs) to compose reusable multi-stage audit workflows [S-0011]. In its developers' design, each data owner encrypts its artifact locally and approves only specific, hashed workflow steps [S-1505]. A key is released only to an enclave whose attestation matches an approved step [S-1505]. Each step emits a certificate that the hardware binds to its code and outputs, and a verifier checks the whole chain, starting from the final certificate [S-1505]. - Enclave-run audits. In Attestable Audits, the model provider and the auditor each encrypt their inputs to an enclave key [S-0009]. The enclave runs the benchmark and publishes to a transparency log an attestation that binds the model hash, the hash of the audit code and data, and the result [S-0009]. - Plan-scoped monitoring. A monitoring party and a monitored party co-sign a plan, which an open-source classifier runs inside an attested TEE; scope changes need fresh signatures from both parties [S-1503]. The plan fixes the inputs, the computation steps and the outputs to be released [S-1504]. - Zero-knowledge audits. In ZkAudit, a provider publishes cryptographic commitments to its dataset and weights, plus a zero-knowledge proof that the weights came from training on that data [S-0022]. It then answers audit requests by computing a function privately and releasing the output with a proof that the computation was correct [S-0022]. - Designing what is disclosed. Minimal Information Disclosure treats the content of the released evidence as a design choice, and aims to minimize what the evidence reveals beyond the authorized result [S-1506]. What it establishes It can establish: - that an agreed computation ran on committed or attested inputs and produced the released result, without revealing the inputs [S-0022] [S-1505]; - in Attestable Audits, that the model answering a user is the one that was audited [S-0009]. It cannot establish: - that nothing was left out of the workflow, since auditors also need assurance that all activity is accounted for [S-0014]; - that the released result reveals nothing else: in one analysis, a one-bit verdict let a predictor tell which of two groups a private request came from with 72.4% balanced accuracy, against 50% by chance [S-1506]; - in ZkAudit, secrecy of the model architecture, which the proofs reveal [S-0022]. Threat model - Cove. Its developers state that it trusts Intel TDX and its attestation roots, Docker's enforcement of the generated configuration, pinned first-party components, and public source code with human review [S-1505]. It does not trust its own storage server, network routing or orchestration [S-1505]. - Attestable Audits. All parties must trust the vendor of the confidential-computing technology, which was AWS in the prototype [S-0009]. - ZkAudit. It rests on cryptographic assumptions, including binding and hiding commitments [S-0022]. - Treaty setting. A governance analysis contrasts the confidential-computing adversary, a dishonest operator, with the adversary in a treaty setting: a state with physical access to data centres and leverage over hardware vendors [S-0014]. Evidence - Cove. Its authors show how its primitives express three applications: capability-attested inference, attested confidential benchmarks and bilateral capability verification [S-0011]. They report an open-source reference implementation on Intel TDX via Phala Cloud's dstack, demonstrated end to end on the benchmark workflow only [S-0011] [S-1505]. - Attestable Audits. The authors ran MMLU, XSum and ToxicChat on a 4-bit Llama-3.1-8B model in CPU-only AWS Nitro Enclaves [S-0009]. They report that CPU inference cost 21.7 times as much per token as GPU inference and ran about 100 times slower [S-0009]. - ZkAudit. Peer-reviewed at ICML 2024 [S-0022]. The authors audited MobileNet v2 image classifiers on three datasets, with accuracy 0.5–0.7 percentage points below full precision, and a small recommender whose error matched full precision [S-0022]. - Auditor-in-a-Box. A reference implementation runs in Tinfoil confidential virtual machines [S-1504]. Its authors state that user data and plan execution in the demo are not actually secure, and that it has not been stress-tested by a counterparty [S-1504]. Limitations - Verdict leakage. Abdelghafar and Kulp found that one-bit reports can reveal sensitive attributes [S-1506]. They propose designing the evidence itself to limit this [S-1506]. - Physical attacks on TEEs. Researchers interposing on the memory bus extracted a per-CPU Intel attestation key and forged TDX attestations [S-1202]. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone before AMD's fix [S-1210] [S-1212]. - Stack trust. Compromise of the Docker daemon, host kernel or TEE stack breaks Cove's guarantees [S-1505]. - Scale. Frontier model inference typically needs the resources of several GPUs [S-0014], and ZkAudit was shown on image classifiers and a recommender model, not frontier-scale language models [S-0022]. - Process. Plan negotiation, false positives and appeals remain open problems [S-1504]. For attesting that a declared safeguard ran on a single service, see Safeguard attestation.",
    "referenced_by": [
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "C-0006",
        "title": "Declared safeguards were applied during inference",
        "url": "https://trustbutveri.fyi/claims/safeguards-were-applied/"
      },
      {
        "id": "K-0006",
        "title": "Trusted execution environment (TEE)",
        "url": "https://trustbutveri.fyi/concepts/trusted-execution-environment/"
      },
      {
        "id": "O-0202",
        "title": "Machine Intelligence Research Institute",
        "url": "https://trustbutveri.fyi/organizations/machine-intelligence-research-institute/"
      },
      {
        "id": "O-0142",
        "title": "University of Cambridge",
        "url": "https://trustbutveri.fyi/organizations/university-of-cambridge/"
      }
    ]
  }
}