Mechanisms · category

Cryptographic & computational

Protocols that check computation itself: recomputation, zero-knowledge proofs, proofs of learning, proofs of work, challenge-response.

Name	Type	Development	Security evidence	Verifies	Threat model
Apple Private Cloud Compute Apple's cloud AI inference service, in which user devices send requests only to servers that attest to running software published in a public transparency log. Product · Realises TEE remote attestation for AI workloads Provider-reported	Implementation	Operational use Operational use for showing users which software serves their AI requests, not which model. Medium confidence. Implementation · Semi-trusted prover	Published attack testing · independent	The declared model is the one being served	Semi-trusted prover
Deterministic and bit-exact inference Making model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately. Provider-reported	Mechanism	Operational use Operational use for reproducing open-model inference from receipts in Gensyn's information-market service. Low confidence. Mechanism · Adversarial prover	Published analysis or argument	The declared model is the one being served This compute runs inference, not training Model weights have not left the facility	Adversarial prover
Hardware-attested weight binding Checks that a hardware enclave serves committed model weights, by attesting software that tests the weights against a hash commitment when they are read. ⚠ Open critical failure Provider-reported	Mechanism	Operational use Operational use for showing users, through hardware attestation, that a service runs its committed weights. Medium confidence. Mechanism · Semi-trusted prover	Published attack testing · independent	The declared model is the one being served Declared safeguards were applied during inference The declared evaluation was run	Semi-trusted prover
Pearl proof-of-useful-work blockchain A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code. Open-source project · Realises Proofs of useful work for capacity accounting Provider-reported	Implementation	Operational use Operational use for checking matrix-multiplication work proofs for blockchain consensus. Low confidence. Implementation · Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
Sampled inference recomputation A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match. Provider-reported	Mechanism	Operational use Operational use for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence. Mechanism · Adversarial prover	Published analysis or argument	The declared model is the one being served Model weights have not left the facility This compute runs inference, not training	Adversarial prover
TEE remote attestation for AI workloads Trusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with. ⚠ Open critical failures Provider-reported	Mechanism	Operational use Operational use for showing a verifier which software ran despite distrust of the hardware operator. Medium confidence. Mechanism · Semi-trusted prover	Published attack testing · independent	The declared evaluation was run The declared model is the one being served Declared safeguards were applied during inference This compute runs inference, not training A training run stayed within declared limits	Semi-trusted prover
Tinfoil model identity (Modelwrap) Tinfoil's open-source tool for proving which model weights its enclave-hosted inference service runs, by building a hash of the weights into the hardware attestation. Product · Realises Hardware-attested weight binding, TEE remote attestation for AI workloads ⚠ Open critical failure Provider-reported	Implementation	Operational use Operational use for showing clients that the served weights match a committed hash. Medium confidence. Implementation · Semi-trusted prover	Published analysis or argument	The declared model is the one being served	Semi-trusted prover
TOPLOC TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims. Open-source project · Realises Sampled inference recomputation Provider-reported	Implementation	Operational use Operational use for checking that untrusted providers used the claimed model, prompt and precision. Low confidence. Implementation · Adversarial prover	Published analysis or argument	The declared model is the one being served	Adversarial prover
Verde and RepOps (Gensyn) Gensyn's system for checking machine-learning jobs given to untrusted providers, which settles disputes by re-running one operation with operators Gensyn reports as bit-identical across hardware. Product · Realises Deterministic and bit-exact inference, Training-transcript verification (proof-of-learning) Provider-reported	Implementation	Operational use Operational use for reproducing declared-model inference from receipts in Gensyn's information-market service. Low confidence. Implementation · Adversarial prover	Published analysis or argument	The declared model is the one being served A training run stayed within declared limits	Adversarial prover
WhatsApp Private Processing Meta's server system for WhatsApp AI features, whose clients check a confidential virtual machine's attestation and transparency-log proofs before connecting. Product · Realises TEE remote attestation for AI workloads Provider-reported	Implementation	Operational use Operational use for showing WhatsApp clients which logged software and artifacts serve their AI requests. Medium confidence. Implementation · Semi-trusted prover	Published analysis or argument	The declared model is the one being served	Semi-trusted prover
Attestable Audits A research prototype that runs AI safety benchmarks inside a trusted execution environment (TEE) and publishes TEE-signed records linking the model, audit and results. Research prototype · Realises TEE remote attestation for AI workloads, Hardware-attested weight binding, Confidential multi-party verification	Implementation	Research demonstration Research demonstration for attesting a benchmark audit run on a confidential model in an enclave. Low confidence. Implementation · Semi-trusted prover	Published analysis or argument	The declared model is the one being served The declared evaluation was run	Semi-trusted prover
Batch-invariant inference kernels (Thinking Machines) Open-source GPU kernels from Thinking Machines Lab that make language-model outputs independent of batch size, adopted in vLLM and SGLang for reproducible inference. Open-source project · Realises Deterministic and bit-exact inference Provider-reported	Implementation	Research demonstration Research demonstration for exact recomputation of served outputs by a verifier, with a cooperating provider. Low confidence. Implementation · Cooperative prover	No published adversarial analysis recorded	The declared model is the one being served	Cooperative prover
Bounding unexplained information in outputs Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.	Mechanism	Research demonstration Research demonstration for bounding how much hidden information can leave in checked inference outputs. Low confidence. Mechanism · Adversarial prover	Published attack testing · independent	Model weights have not left the facility This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
Confidential multi-party verification Parties who distrust each other run an agreed check on private models or records, using attested enclaves or zero-knowledge proofs, releasing only the result.	Mechanism	Research demonstration Research demonstration for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence. Mechanism · Semi-trusted prover	Published analysis or argument	The declared evaluation was run The declared model is the one being served Declared safeguards were applied during inference A training run stayed within declared limits	Semi-trusted prover
Cove Draft Parties who distrust each other chain enclave-run stages; owners release keys to private data only to stages they approved, and each stage issues a certificate. Open-source project · Realises Confidential multi-party verification, TEE remote attestation for AI workloads Provider-reported	Implementation	Research demonstration Draft. Research demonstration for composing owner-approved confidential workflow stages on Intel TDX. Medium confidence. Implementation · Semi-trusted prover	Published analysis or argument	The declared evaluation was run	Semi-trusted prover
DiFR (Divergence From Reference) DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed. Research prototype · Realises Sampled inference recomputation	Implementation	Research demonstration Research demonstration for checking that outputs match the declared model, precision and sampling settings. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	The declared model is the one being served Model weights have not left the facility	Adversarial prover
EZKL EZKL is a library from Zkonduit that turns neural networks into zero-knowledge circuits, so a prover can show an output came from a committed model. Product · Realises Zero-knowledge proofs of inference	Implementation	Research demonstration Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence. Implementation · Adversarial prover	Published attack testing · independent	The declared model is the one being served The declared evaluation was run	Adversarial prover
GPU contention probes Draft Three timed GPU puzzles whose solve times lengthen when another workload shares the device, a heuristic sign to a verifier that the GPU is shared. Research prototype · Realises Timed challenge-response and memory-occupation challenges	Implementation	Research demonstration Draft. Research demonstration for detecting another workload running on the same GPU. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	Declared hardware is idle or shut down	Adversarial prover
Kaizen Draft A trainer proves in zero knowledge that a public training algorithm on committed data produced the model; the proof does not grow with training length. Research prototype · Realises Zero-knowledge proofs of training constraints	Implementation	Research demonstration Draft. Research demonstration for proving gradient-descent training of small image models on committed data. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	A training run stayed within declared limits	Adversarial prover
PAL*M Draft A research prototype in which confidential-computing hardware signs hashes of the models, datasets and results involved in training, evaluation and inference. Research prototype · Realises TEE remote attestation for AI workloads, Hardware-attested weight binding	Implementation	Research demonstration Draft. Research demonstration for attesting declared model operations on a confidential CPU–GPU prototype. Medium confidence. Implementation · Semi-trusted prover	Published analysis or argument	The declared model is the one being served The declared evaluation was run A training run stayed within declared limits	Semi-trusted prover
PySyft double-blind evaluations OpenMined's PySyft lets a model owner and an evaluator run tests in an attested enclave without showing each other the weights or the private prompts. Research prototype · Realises Confidential multi-party verification Provider-reported	Implementation	Research demonstration Research demonstration for evaluating a private model on private prompts, neither party seeing the other's inputs. Medium confidence. Implementation · Semi-trusted prover	Published analysis or argument	The declared evaluation was run	Semi-trusted prover
Safeguard attestation TEE-signed evidence that an AI service sent a given response through its declared safeguard path, such as a wrapper that calls a guardrail classifier. Provider-reported	Mechanism	Research demonstration Research demonstration for attesting that a declared safeguard mediated a service's responses. Low confidence. Mechanism · Semi-trusted prover	Published analysis or argument	Declared safeguards were applied during inference	Semi-trusted prover
SAGE Draft A software-only attestation scheme in which a GPU must compute a checksum over its own code within a time limit, without trusted GPU hardware. Research prototype · Realises Timed challenge-response and memory-occupation challenges	Implementation	Research demonstration Draft. Research demonstration for attesting code execution on a GPU that lacks hardware trusted-execution support. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	The declared model is the one being served	Adversarial prover
Timed challenge-response and memory-occupation challenges A verifier times answers to unpredictable questions designed so that answering correctly and in time requires holding specified data locally or dedicating specified resources.	Mechanism	Research demonstration Research demonstration for detecting whether a GPU is doing other work. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	Declared hardware is idle or shut down This compute runs inference, not training Chips are where they are declared to be The declared model is the one being served	Adversarial prover
Training-transcript verification (proof-of-learning) A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened. ⚠ Open critical failure	Mechanism	Research demonstration Research demonstration for checking from its transcript that a training run followed declared rules. Medium confidence. Mechanism · Adversarial prover	Published attack testing · independent	A training run stayed within declared limits	Adversarial prover
VeriLoRA Draft Lets a developer prove that individual low-rank (LoRA) fine-tuning steps on a language model were computed correctly, without revealing private weights or training data. Research prototype · Realises Zero-knowledge proofs of training constraints	Implementation	Research demonstration Draft. Research demonstration for proving single-sample LoRA fine-tuning steps for 3–13-billion-parameter language models. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	A training run stayed within declared limits	Adversarial prover
VRAM-residency challenge Draft A timed challenge that tests whether verifier-supplied data is still held in a GPU's on-board memory or has moved to host memory. Research prototype · Realises Timed challenge-response and memory-occupation challenges	Implementation	Research demonstration Draft. Research demonstration for detecting whether verifier-supplied data remains in a single GPU's memory. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	Declared hardware is idle or shut down	Adversarial prover
Zero-knowledge proofs of inference A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.	Mechanism	Research demonstration Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence. Mechanism · Adversarial prover	Published attack testing · independent	The declared model is the one being served This compute runs inference, not training Declared safeguards were applied during inference The declared evaluation was run	Adversarial prover
Zero-knowledge proofs of training constraints Cryptographic proofs that a training run used a dataset and followed a procedure and rules fixed in advance, checkable without seeing the model or data.	Mechanism	Research demonstration Research demonstration for proving a training run followed a committed specification and data. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	A training run stayed within declared limits	Adversarial prover
zkLLM zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights. Research prototype · Realises Zero-knowledge proofs of inference	Implementation	Research demonstration Research demonstration for proving an output came from committed weights, against a prover who cheats. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	The declared model is the one being served	Adversarial prover
AI 2040 inference-only verification stack A proposed retrofit that splits data centres into isolated inference units, copies front-end traffic and re-runs random samples to confirm only declared inference runs. Proposed architecture · Realises Network taps and certifiers, Sampled inference recomputation, Whole-workload recomputation (reproducible packets), Bandwidth limits and compartmentalization, Memory wiping and proofs of secure erasure, Tamper evidence for verifier devices, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for showing that retrofitted data centres run only inference. Medium confidence. Implementation · Adversarial prover	No published adversarial analysis recorded	This compute runs inference, not training The declared model is the one being served Communication between compute groups is bounded	Adversarial prover
Attestable zero-knowledge inference prover Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second. Product · Realises Zero-knowledge proofs of inference Provider-reported	Implementation	Proposed Proposed for proving an output came from committed weights. Low confidence. Implementation · Adversarial prover	No published adversarial analysis recorded	The declared model is the one being served This compute runs inference, not training Declared safeguards were applied during inference	Adversarial prover
Chip registries and manufacturing records Recording each AI chip's identity and owner from manufacture onwards, and publishing a cryptographic fingerprint of manufacturing records, so chips can be accounted for later.	Mechanism	Proposed Proposed for a checkable record of which chips were made and who declared owning them. Medium confidence. Mechanism · Semi-trusted prover	Published analysis or argument	Compute stock is at most a declared amount There is no undeclared relevant compute Chips are where they are declared to be	Semi-trusted prover
Data-centre memory challenging Draft A proposed design that times answers from a data centre's memory to check that declared data is present or that no free memory remains. Proposed architecture · Realises Timed challenge-response and memory-occupation challenges Provider-reported	Implementation	Proposed Draft. Proposed for confirming data presence and bounding free memory across data-centre servers. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
Low-trust AI compute verification system overview A reference design that existing data centres could add: network taps hash all traffic, and air-gapped, independently sourced checkers later re-run randomly chosen records. Proposed architecture · Realises Network taps and certifiers, Sampled inference recomputation, Deterministic and bit-exact inference, Zero-knowledge proofs of inference, Memory wiping and proofs of secure erasure, Timed challenge-response and memory-occupation challenges, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for screening challenged records to show declared inference compute is not training. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	This compute runs inference, not training The declared model is the one being served Declared safeguards were applied during inference Communication between compute groups is bounded	Adversarial prover
Memory wiping and proofs of secure erasure Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches.	Mechanism	Proposed Proposed for showing that no data from earlier work persists in memory the wipe reaches. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
Model fingerprint attestation A proposed timed challenge that tests whether declared model weights are already in a chip's memory. Proposed architecture · Realises Timed challenge-response and memory-occupation challenges	Implementation	Proposed Proposed for checking residency of declared model weights with timed challenges. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	The declared model is the one being served	Adversarial prover
Network taps and certifiers Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.	Mechanism	Proposed Proposed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training Model weights have not left the facility The declared model is the one being served A training run stayed within declared limits	Adversarial prover
Proofs of useful work for capacity accounting Cryptographic evidence of matrix-multiplication work, from which total work is estimated statistically, proposed as one input to bounding the spare capacity of declared hardware. Provider-reported	Mechanism	Proposed Proposed for bounding the spare capacity of declared hardware that could run training. Low confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
SASH confidential network logger An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check the facility serves inference. Research prototype · Realises Network taps and certifiers, Sampled inference recomputation Provider-reported	Implementation	Proposed Proposed for telling inference from training on a mutually inspected cluster. Medium confidence. Implementation · Semi-trusted prover	No published adversarial analysis recorded	This compute runs inference, not training The declared model is the one being served	Semi-trusted prover
Whole-workload recomputation (reproducible packets) Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.	Mechanism	Proposed Proposed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training A training run stayed within declared limits	Adversarial prover

Includes records that list this as a secondary category. Claims in grey italics are supported rather than aimed at.