Mechanisms · category

Isolation & system architectures

Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.

NameTypeReadinessVerifiesThreat model
Bounding unexplained information in outputs
Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.
MechanismR2DemonstratedModel weights or data have not left the facilityAdversarial prover
Tamper evidence for verifier devices
Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating.
MechanismR2DemonstratedAdversarial prover
AI 2040 inference-only verification stack
A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs.
ImplementationR1ProposedThis compute runs inference, not trainingAdversarial prover
Bandwidth limits and compartmentalization
Capping or removing the network links between groups of accelerators, so that serving models still works but large training runs become impractically slow.
MechanismR1ProposedCommunication between compute groups is boundedAdversarial prover
Hardware-enabled guarantees (flexHEG) and guarantee processors
Proposed chip add-ons, a guarantee processor inside a tamper-protected enclosure, that would check and enforce agreed rules on how AI accelerators are used.
MechanismR1ProposedA training run stayed within declared limitsAdversarial prover
Low-trust AI compute verification system overview
A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.
ImplementationR1ProposedThis compute runs inference, not trainingAdversarial prover
Memory wiping and proofs of secure erasure
Overwriting all of a device's memory in a way a verifier can check, so that nothing from earlier, undeclared work survives the wipe.
MechanismR1ProposedAdversarial prover
RAND secure inference data center (SIDC) design
A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.
ImplementationR1ProposedModel weights or data have not left the facilitySemi-trusted prover
Reproducible computation packets
Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.
MechanismR1ProposedThis compute runs inference, not trainingAdversarial prover
Side-channel suppression for isolated facilities
Shielding, filtering, jamming and inspecting an AI facility so that no hidden physical channel can bypass the checks placed on its official links.
MechanismR1ProposedCommunication between compute groups is boundedAdversarial prover

Includes records that list this as a secondary category.