Off-chip devices & sensors

Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating.

Telling whether chips are training, serving or doing non-AI work from GPU counters or power draw, signals that do not read weights or data.

A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs.

Capping or removing the network links between groups of accelerators, so that serving models still works but large training runs become impractically slow.

A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records.

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.

A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers.

An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference.

Shielding, filtering, jamming and inspecting an AI facility so that no hidden physical channel can bypass the checks placed on its official links.