Cryptographic & computational

A research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results.

Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.

Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.

Making model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately.

DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.

Establishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.

A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code.

A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened.

Hardware-signed evidence that an AI service ran its declared safeguards, such as a guardrail classifier or monitor, when producing a given response.

A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.

Tinfoil's method for proving which model weights its enclave-hosted inference service runs, by binding a dm-verity hash of the weights into remote attestation.

TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims.

A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.

Cryptographic proofs that a training run followed a committed dataset, procedure and rules, checkable without revealing the model or the data.

zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights.

A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs.

Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second.

Recording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later.

A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.

Overwriting all of a device's memory in a way a verifier can check, so that nothing from earlier, undeclared work survives the wipe.

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.

Cryptographic evidence that hardware performed a given amount of agreed computation, proposed as a way to show no spare capacity remained for other work.

Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.

An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference.

A verifier sends unpredictable questions that a device can answer in time only if it holds specified data, or dedicates specified resources, locally.