Browse

Verification mechanisms and implementations.

Name	Development	Security evidence	Type	Category	Threat model	Hardware
Apple Private Cloud Compute Apple's cloud AI inference service, in which user devices send requests only to servers that attest to running software published in a public transparency log. Provider-reported	Operational use Operational use for showing users which software serves their AI requests, not which model. Medium confidence. Implementation · On-chip · Semi-trusted prover	Published attack testing · independent	Implementation	On-chip	Semi-trusted prover	Existing features
Deterministic and bit-exact inference Making model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately. Provider-reported	Operational use Operational use for reproducing open-model inference from receipts in Gensyn's information-market service. Low confidence. Mechanism · Crypto / compute · Adversarial prover	Published analysis or argument	Mechanism	Crypto / compute	Adversarial prover	None
Hardware-attested weight binding Checks that a hardware enclave serves committed model weights, by attesting software that tests the weights against a hash commitment when they are read. ⚠ Open critical failure Provider-reported	Operational use Operational use for showing users, through hardware attestation, that a service runs its committed weights. Medium confidence. Mechanism · Crypto / compute · Semi-trusted prover	Published attack testing · independent	Mechanism	Crypto / compute	Semi-trusted prover	Existing features
Pearl proof-of-useful-work blockchain A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code. Provider-reported	Operational use Operational use for checking matrix-multiplication work proofs for blockchain consensus. Low confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
Sampled inference recomputation A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match. Provider-reported	Operational use Operational use for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence. Mechanism · Crypto / compute · Adversarial prover	Published analysis or argument	Mechanism	Crypto / compute	Adversarial prover	None
TEE remote attestation for AI workloads Trusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with. ⚠ Open critical failures Provider-reported	Operational use Operational use for showing a verifier which software ran despite distrust of the hardware operator. Medium confidence. Mechanism · On-chip · Semi-trusted prover	Published attack testing · independent	Mechanism	On-chip	Semi-trusted prover	Existing features
Tinfoil model identity (Modelwrap) Tinfoil's open-source tool for proving which model weights its enclave-hosted inference service runs, by building a hash of the weights into the hardware attestation. ⚠ Open critical failure Provider-reported	Operational use Operational use for showing clients that the served weights match a committed hash. Medium confidence. Implementation · Crypto / compute · Semi-trusted prover	Published analysis or argument	Implementation	Crypto / compute	Semi-trusted prover	Existing features
TOPLOC TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims. Provider-reported	Operational use Operational use for checking that untrusted providers used the claimed model, prompt and precision. Low confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
Verde and RepOps (Gensyn) Gensyn's system for checking machine-learning jobs given to untrusted providers, which settles disputes by re-running one operation with operators Gensyn reports as bit-identical across hardware. Provider-reported	Operational use Operational use for reproducing declared-model inference from receipts in Gensyn's information-market service. Low confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
WhatsApp Private Processing Meta's server system for WhatsApp AI features, whose clients check a confidential virtual machine's attestation and transparency-log proofs before connecting. Provider-reported	Operational use Operational use for showing WhatsApp clients which logged software and artifacts serve their AI requests. Medium confidence. Implementation · On-chip · Semi-trusted prover	Published analysis or argument	Implementation	On-chip	Semi-trusted prover	Existing features
Attestable Audits A research prototype that runs AI safety benchmarks inside a trusted execution environment (TEE) and publishes TEE-signed records linking the model, audit and results.	Research demonstration Research demonstration for attesting a benchmark audit run on a confidential model in an enclave. Low confidence. Implementation · On-chip · Semi-trusted prover	Published analysis or argument	Implementation	On-chip	Semi-trusted prover	Existing features
Bandwidth limits and compartmentalization Capping or removing network links between groups of AI chips, so each can serve models but pre-training beyond the current frontier becomes far slower.	Research demonstration Research demonstration for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence. Mechanism · Isolation & architecture · Adversarial prover	Published analysis or argument	Mechanism	Isolation & architecture	Adversarial prover	Retrofit device
Batch-invariant inference kernels (Thinking Machines) Open-source GPU kernels from Thinking Machines Lab that make language-model outputs independent of batch size, adopted in vLLM and SGLang for reproducible inference. Provider-reported	Research demonstration Research demonstration for exact recomputation of served outputs by a verifier, with a cooperating provider. Low confidence. Implementation · Crypto / compute · Cooperative prover	No published adversarial analysis recorded	Implementation	Crypto / compute	Cooperative prover	None
Bounding unexplained information in outputs Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.	Research demonstration Research demonstration for bounding how much hidden information can leave in checked inference outputs. Low confidence. Mechanism · Isolation & architecture · Adversarial prover	Published attack testing · independent	Mechanism	Isolation & architecture	Adversarial prover	Retrofit device
Confidential multi-party verification Parties who distrust each other run an agreed check on private models or records, using attested enclaves or zero-knowledge proofs, releasing only the result.	Research demonstration Research demonstration for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence. Mechanism · Crypto / compute · Semi-trusted prover	Published analysis or argument	Mechanism	Crypto / compute	Semi-trusted prover	Existing features
Cove Draft Parties who distrust each other chain enclave-run stages; owners release keys to private data only to stages they approved, and each stage issues a certificate. Provider-reported	Research demonstration Research demonstration for composing owner-approved confidential workflow stages on Intel TDX. Medium confidence. Implementation · Crypto / compute · Semi-trusted prover	Published analysis or argument	Implementation	Crypto / compute	Semi-trusted prover	Existing features
DiFR (Divergence From Reference) DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.	Research demonstration Research demonstration for checking that outputs match the declared model, precision and sampling settings. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
EZKL EZKL is a library from Zkonduit that turns neural networks into zero-knowledge circuits, so a prover can show an output came from a committed model.	Research demonstration Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published attack testing · independent	Implementation	Crypto / compute	Adversarial prover	None
GPU contention probes Draft Three timed GPU puzzles whose solve times lengthen when another workload shares the device, a heuristic sign to a verifier that the GPU is shared.	Research demonstration Research demonstration for detecting another workload running on the same GPU. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
Kaizen Draft A trainer proves in zero knowledge that a public training algorithm on committed data produced the model; the proof does not grow with training length.	Research demonstration Research demonstration for proving gradient-descent training of small image models on committed data. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
On-chip telemetry from timing, memory and performance counters On-chip measurements, such as task timings, whether data sits in chip memory, and performance counters, used as statistical evidence of what AI chips are running.	Research demonstration Research demonstration for workload evidence from GPU counters and timing, assuming authentic measurements. Medium confidence. Mechanism · On-chip · Semi-trusted prover	Published attack testing · developers	Mechanism	On-chip	Semi-trusted prover	Existing features
PAL*M Draft A research prototype in which confidential-computing hardware signs hashes of the models, datasets and results involved in training, evaluation and inference.	Research demonstration Research demonstration for attesting declared model operations on a confidential CPU–GPU prototype. Medium confidence. Implementation · On-chip · Semi-trusted prover	Published analysis or argument	Implementation	On-chip	Semi-trusted prover	Existing features
PySyft double-blind evaluations OpenMined's PySyft lets a model owner and an evaluator run tests in an attested enclave without showing each other the weights or the private prompts. Provider-reported	Research demonstration Research demonstration for evaluating a private model on private prompts, neither party seeing the other's inputs. Medium confidence. Implementation · Crypto / compute · Semi-trusted prover	Published analysis or argument	Implementation	Crypto / compute	Semi-trusted prover	Existing features
Safeguard attestation TEE-signed evidence that an AI service sent a given response through its declared safeguard path, such as a wrapper that calls a guardrail classifier. Provider-reported	Research demonstration Research demonstration for attesting that a declared safeguard mediated a service's responses. Low confidence. Mechanism · Crypto / compute · Semi-trusted prover	Published analysis or argument	Mechanism	Crypto / compute	Semi-trusted prover	Existing features
SAGE Draft A software-only attestation scheme in which a GPU must compute a checksum over its own code within a time limit, without trusted GPU hardware.	Research demonstration Research demonstration for attesting code execution on a GPU that lacks hardware trusted-execution support. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	Existing features
Tamper evidence for verifier devices Enclosures, seals and sensors that make physical interference with verification hardware visible, or that destroy the hardware's secrets when tampering occurs.	Research demonstration Research demonstration for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence. Medium confidence. Mechanism · Off-chip devices · Adversarial prover	Published analysis or argument	Mechanism	Off-chip devices	Adversarial prover	Retrofit device
Timed challenge-response and memory-occupation challenges A verifier times answers to unpredictable questions designed so that answering correctly and in time requires holding specified data locally or dedicating specified resources.	Research demonstration Research demonstration for detecting whether a GPU is doing other work. Medium confidence. Mechanism · Crypto / compute · Adversarial prover	Published analysis or argument	Mechanism	Crypto / compute	Adversarial prover	None
Training-transcript verification (proof-of-learning) A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened. ⚠ Open critical failure	Research demonstration Research demonstration for checking from its transcript that a training run followed declared rules. Medium confidence. Mechanism · Crypto / compute · Adversarial prover	Published attack testing · independent	Mechanism	Crypto / compute	Adversarial prover	None
VeriLoRA Draft Lets a developer prove that individual low-rank (LoRA) fine-tuning steps on a language model were computed correctly, without revealing private weights or training data.	Research demonstration Research demonstration for proving single-sample LoRA fine-tuning steps for 3–13-billion-parameter language models. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
VRAM-residency challenge Draft A timed challenge that tests whether verifier-supplied data is still held in a GPU's on-board memory or has moved to host memory.	Research demonstration Research demonstration for detecting whether verifier-supplied data remains in a single GPU's memory. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
Workload classification from telemetry and side channels Inferring from GPU counters or power draw whether chips are training models, serving them or doing non-AI work, without reading weights or data.	Research demonstration Research demonstration for telling training from inference and other work using genuine telemetry, including disguised workloads. Medium confidence. Mechanism · Sensing · Adversarial prover	Published attack testing · developers	Mechanism	Sensing	Adversarial prover	Existing features
Zero-knowledge proofs of inference A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.	Research demonstration Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence. Mechanism · Crypto / compute · Adversarial prover	Published attack testing · independent	Mechanism	Crypto / compute	Adversarial prover	None
Zero-knowledge proofs of training constraints Cryptographic proofs that a training run used a dataset and followed a procedure and rules fixed in advance, checkable without seeing the model or data.	Research demonstration Research demonstration for proving a training run followed a committed specification and data. Medium confidence. Mechanism · Crypto / compute · Adversarial prover	Published analysis or argument	Mechanism	Crypto / compute	Adversarial prover	None
zkLLM zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights.	Research demonstration Research demonstration for proving an output came from committed weights, against a prover who cheats. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
AI 2040 inference-only verification stack A proposed retrofit that splits data centres into isolated inference units, copies front-end traffic and re-runs random samples to confirm only declared inference runs. Provider-reported	Proposed Proposed for showing that retrofitted data centres run only inference. Medium confidence. Implementation · Isolation & architecture · Adversarial prover	No published adversarial analysis recorded	Implementation	Isolation & architecture	Adversarial prover	Retrofit device
Attestable zero-knowledge inference prover Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second. Provider-reported	Proposed Proposed for proving an output came from committed weights. Low confidence. Implementation · Crypto / compute · Adversarial prover	No published adversarial analysis recorded	Implementation	Crypto / compute	Adversarial prover	None
Chip location verification Timing a chip's signed replies to trusted servers at known places, so that the speed of light bounds how far away the chip can be.	Proposed Proposed for bounding how far a chip is from trusted landmark servers when checked. Medium confidence. Mechanism · Accounting · Adversarial prover	Published analysis or argument	Mechanism	Accounting	Adversarial prover	Existing features
Chip registries and manufacturing records Recording each AI chip's identity and owner from manufacture onwards, and publishing a cryptographic fingerprint of manufacturing records, so chips can be accounted for later.	Proposed Proposed for a checkable record of which chips were made and who declared owning them. Medium confidence. Mechanism · Accounting · Semi-trusted prover	Published analysis or argument	Mechanism	Accounting	Semi-trusted prover	Existing features
Data-centre memory challenging Draft A proposed design that times answers from a data centre's memory to check that declared data is present or that no free memory remains. Provider-reported	Proposed Proposed for confirming data presence and bounding free memory across data-centre servers. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	Retrofit device
Hardware performance throttling and licensing Proposed on-chip mechanisms that cut an AI accelerator's performance when a license expires or a trusted trigger fires, bounding what the hardware can do.	Proposed Proposed for performance limits a verifier can rely on, against an operator trying to bypass them. Medium confidence. Mechanism · On-chip · Adversarial prover	Published analysis or argument	Mechanism	On-chip	Adversarial prover	New chip design
Hardware-enabled guarantees (flexHEG) and guarantee processors A proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.	Proposed Proposed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence. Mechanism · On-chip · Adversarial prover	Published analysis or argument	Mechanism	On-chip	Adversarial prover	New chip design
Low-trust AI compute verification system overview A reference design that existing data centres could add: network taps hash all traffic, and air-gapped, independently sourced checkers later re-run randomly chosen records. Provider-reported	Proposed Proposed for screening challenged records to show declared inference compute is not training. Medium confidence. Implementation · Isolation & architecture · Adversarial prover	Published analysis or argument	Implementation	Isolation & architecture	Adversarial prover	Retrofit device
Lucid sovereignty (location) certificates A draft specification, hosted by Lucid Computing, for short-lived certificates that bound where a workload runs by timing signed messages to servers at known locations. Provider-reported	Proposed Proposed for certifying the region where an attested workload ran at a given time. Medium confidence. Implementation · Accounting · Semi-trusted prover	Published analysis or argument	Implementation	Accounting	Semi-trusted prover	Existing features
Memory wiping and proofs of secure erasure Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches.	Proposed Proposed for showing that no data from earlier work persists in memory the wipe reaches. Medium confidence. Mechanism · Isolation & architecture · Adversarial prover	Published analysis or argument	Mechanism	Isolation & architecture	Adversarial prover	None
Model fingerprint attestation A proposed timed challenge that tests whether declared model weights are already in a chip's memory.	Proposed Proposed for checking residency of declared model weights with timed challenges. Medium confidence. Implementation · Crypto / compute · Adversarial prover	Published analysis or argument	Implementation	Crypto / compute	Adversarial prover	None
Network taps and certifiers Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.	Proposed Proposed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence. Mechanism · Off-chip devices · Adversarial prover	Published analysis or argument	Mechanism	Off-chip devices	Adversarial prover	Retrofit device
Proofs of useful work for capacity accounting Cryptographic evidence of matrix-multiplication work, from which total work is estimated statistically, proposed as one input to bounding the spare capacity of declared hardware. Provider-reported	Proposed Proposed for bounding the spare capacity of declared hardware that could run training. Low confidence. Mechanism · Crypto / compute · Adversarial prover	Published analysis or argument	Mechanism	Crypto / compute	Adversarial prover	None
RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. Provider-reported	Proposed Proposed for the operator's own weight security, with no outside verification described. Low confidence. Implementation · Isolation & architecture · Semi-trusted prover	Published analysis or argument	Implementation	Isolation & architecture	Semi-trusted prover	Retrofit device
Remote detection of data centres Remote detection tracks known large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records.	Proposed Proposed for finding undeclared data centres above an agreed compute threshold. Medium confidence. Mechanism · Sensing · Adversarial prover	Published analysis or argument	Mechanism	Sensing	Adversarial prover	None
SASH confidential network logger An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check the facility serves inference. Provider-reported	Proposed Proposed for telling inference from training on a mutually inspected cluster. Medium confidence. Implementation · Off-chip devices · Semi-trusted prover	No published adversarial analysis recorded	Implementation	Off-chip devices	Semi-trusted prover	Retrofit device
Side-channel suppression for isolated facilities Shielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.	Proposed Proposed for bounding physical covert channels out of a verified enclosure. Medium confidence. Mechanism · Off-chip devices · Adversarial prover	Published analysis or argument	Mechanism	Off-chip devices	Adversarial prover	Retrofit device
Whole-workload recomputation (reproducible packets) Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.	Proposed Proposed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence. Mechanism · Isolation & architecture · Adversarial prover	Published analysis or argument	Mechanism	Isolation & architecture	Adversarial prover	Retrofit device