Mechanisms · category
Isolation & system architectures
Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.
| Name | Type | Readiness | Verifies | Threat model |
|---|---|---|---|---|
| Bounding unexplained information in outputs Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict. | Mechanism | R2Demonstrated | Model weights or data have not left the facility | Adversarial prover |
| Tamper evidence for verifier devices Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating. | Mechanism | R2Demonstrated | Adversarial prover | |
| AI 2040 inference-only verification stack A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs. | Implementation | R1Proposed | This compute runs inference, not training | Adversarial prover |
| Bandwidth limits and compartmentalization Capping or removing the network links between groups of accelerators, so that serving models still works but large training runs become impractically slow. | Mechanism | R1Proposed | Communication between compute groups is bounded | Adversarial prover |
| Hardware-enabled guarantees (flexHEG) and guarantee processors Proposed chip add-ons, a guarantee processor inside a tamper-protected enclosure, that would check and enforce agreed rules on how AI accelerators are used. | Mechanism | R1Proposed | A training run stayed within declared limits | Adversarial prover |
| Low-trust AI compute verification system overview A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records. | Implementation | R1Proposed | This compute runs inference, not training | Adversarial prover |
| Memory wiping and proofs of secure erasure Overwriting all of a device's memory in a way a verifier can check, so that nothing from earlier, undeclared work survives the wipe. | Mechanism | R1Proposed | Adversarial prover | |
| RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. | Implementation | R1Proposed | Model weights or data have not left the facility | Semi-trusted prover |
| Reproducible computation packets Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one. | Mechanism | R1Proposed | This compute runs inference, not training | Adversarial prover |
| Side-channel suppression for isolated facilities Shielding, filtering, jamming and inspecting an AI facility so that no hidden physical channel can bypass the checks placed on its official links. | Mechanism | R1Proposed | Communication between compute groups is bounded | Adversarial prover |
Includes records that list this as a secondary category.