Browse

A research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results.

Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.

Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.

Making model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.

DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.

Establishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.

Uses timing, memory-residency and performance-counter signals measured on AI accelerators as evidence about which workloads they are running.

A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code.

A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened.

Hardware-signed evidence that an AI service ran its declared safeguards, such as a guardrail classifier or monitor, when producing a given response.

A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.

Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating.

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.

Tinfoil's method for proving which model weights its enclave-hosted inference service runs, by binding a dm-verity hash of the weights into remote attestation.

TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims.

Telling whether chips are training, serving or doing non-AI work from GPU counters or power draw, signals that do not read weights or data.

A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.

Cryptographic proofs that a training run followed a committed dataset, procedure and rules, checkable without revealing the model or the data.

zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights.

A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs.

Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second.

Capping or removing the network links between groups of accelerators, so that serving models still works but large training runs become impractically slow.

Timing a chip's signed replies to trusted servers at known places, so that the speed of light bounds how far away the chip can be.

Recording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later.

On-chip mechanisms that cut an AI accelerator's performance when a license expires or a trusted trigger fires, bounding what the hardware can do.

Proposed chip add-ons, a guarantee processor inside a tamper-protected enclosure, that would check and enforce agreed rules on how AI accelerators are used.

A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.

A draft specification, hosted by Lucid Computing, for short-lived certificates that bound where a workload runs by timing signed exchanges with fixed anchors.

Overwriting all of a device's memory in a way a verifier can check, so that nothing from earlier, undeclared work survives the wipe.

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.

Cryptographic evidence that hardware performed a given amount of agreed computation, proposed as a way to show no spare capacity remained for other work.

A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.

Remote detection locates large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records such as permits.

Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.

An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference.

Shielding, filtering, jamming and inspecting an AI facility so that no hidden physical channel can bypass the checks placed on its official links.

A verifier sends unpredictable questions that a device can answer in time only if it holds specified data, or dedicates specified resources, locally.