Mechanisms · category

Isolation & system architectures

Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.

Name	Type	Development	Security evidence	Verifies	Threat model
Bandwidth limits and compartmentalization Capping or removing network links between groups of AI chips, so each can serve models but pre-training beyond the current frontier becomes far slower.	Mechanism	Research demonstration Research demonstration for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence. Mechanism · Adversarial prover	Published analysis or argument	Communication between compute groups is bounded This compute runs inference, not training A training run stayed within declared limits Model weights have not left the facility	Adversarial prover
Bounding unexplained information in outputs Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.	Mechanism	Research demonstration Research demonstration for bounding how much hidden information can leave in checked inference outputs. Low confidence. Mechanism · Adversarial prover	Published attack testing · independent	Model weights have not left the facility This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
Tamper evidence for verifier devices Enclosures, seals and sensors that make physical interference with verification hardware visible, or that destroy the hardware's secrets when tampering occurs.	Mechanism	Research demonstration Research demonstration for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
AI 2040 inference-only verification stack A proposed retrofit that splits data centres into isolated inference units, copies front-end traffic and re-runs random samples to confirm only declared inference runs. Proposed architecture · Realises Network taps and certifiers, Sampled inference recomputation, Whole-workload recomputation (reproducible packets), Bandwidth limits and compartmentalization, Memory wiping and proofs of secure erasure, Tamper evidence for verifier devices, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for showing that retrofitted data centres run only inference. Medium confidence. Implementation · Adversarial prover	No published adversarial analysis recorded	This compute runs inference, not training The declared model is the one being served Communication between compute groups is bounded	Adversarial prover
Hardware-enabled guarantees (flexHEG) and guarantee processors A proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.	Mechanism	Proposed Proposed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	A training run stayed within declared limits The declared model is the one being served Chips are where they are declared to be Communication between compute groups is bounded Declared safeguards were applied during inference	Adversarial prover
Low-trust AI compute verification system overview A reference design that existing data centres could add: network taps hash all traffic, and air-gapped, independently sourced checkers later re-run randomly chosen records. Proposed architecture · Realises Network taps and certifiers, Sampled inference recomputation, Deterministic and bit-exact inference, Zero-knowledge proofs of inference, Memory wiping and proofs of secure erasure, Timed challenge-response and memory-occupation challenges, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for screening challenged records to show declared inference compute is not training. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	This compute runs inference, not training The declared model is the one being served Declared safeguards were applied during inference Communication between compute groups is bounded	Adversarial prover
Memory wiping and proofs of secure erasure Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches.	Mechanism	Proposed Proposed for showing that no data from earlier work persists in memory the wipe reaches. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. Proposed architecture · Realises Bandwidth limits and compartmentalization, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for the operator's own weight security, with no outside verification described. Low confidence. Implementation · Semi-trusted prover	Published analysis or argument	Model weights have not left the facility The declared model is the one being served Communication between compute groups is bounded	Semi-trusted prover
Side-channel suppression for isolated facilities Shielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.	Mechanism	Proposed Proposed for bounding physical covert channels out of a verified enclosure. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	Communication between compute groups is bounded Model weights have not left the facility This compute runs inference, not training	Adversarial prover
Whole-workload recomputation (reproducible packets) Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.	Mechanism	Proposed Proposed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training A training run stayed within declared limits	Adversarial prover

Includes records that list this as a secondary category. Claims in grey italics are supported rather than aimed at.