Mechanisms · category

Off-chip devices & sensors

Retrofittable devices outside the accelerator: network taps and certifiers, power and analog sensors, tamper-evident enclosures.

Name	Type	Development	Security evidence	Verifies	Threat model
Bandwidth limits and compartmentalization Capping or removing network links between groups of AI chips, so each can serve models but pre-training beyond the current frontier becomes far slower.	Mechanism	Research demonstration Research demonstration for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence. Mechanism · Adversarial prover	Published analysis or argument	Communication between compute groups is bounded This compute runs inference, not training A training run stayed within declared limits Model weights have not left the facility	Adversarial prover
Tamper evidence for verifier devices Enclosures, seals and sensors that make physical interference with verification hardware visible, or that destroy the hardware's secrets when tampering occurs.	Mechanism	Research demonstration Research demonstration for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
Workload classification from telemetry and side channels Inferring from GPU counters or power draw whether chips are training models, serving them or doing non-AI work, without reading weights or data.	Mechanism	Research demonstration Research demonstration for telling training from inference and other work using genuine telemetry, including disguised workloads. Medium confidence. Mechanism · Adversarial prover	Published attack testing · developers	This compute runs inference, not training A training run stayed within declared limits	Adversarial prover
AI 2040 inference-only verification stack A proposed retrofit that splits data centres into isolated inference units, copies front-end traffic and re-runs random samples to confirm only declared inference runs. Proposed architecture · Realises Network taps and certifiers, Sampled inference recomputation, Whole-workload recomputation (reproducible packets), Bandwidth limits and compartmentalization, Memory wiping and proofs of secure erasure, Tamper evidence for verifier devices, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for showing that retrofitted data centres run only inference. Medium confidence. Implementation · Adversarial prover	No published adversarial analysis recorded	This compute runs inference, not training The declared model is the one being served Communication between compute groups is bounded	Adversarial prover
Data-centre memory challenging Draft A proposed design that times answers from a data centre's memory to check that declared data is present or that no free memory remains. Proposed architecture · Realises Timed challenge-response and memory-occupation challenges Provider-reported	Implementation	Proposed Draft. Proposed for confirming data presence and bounding free memory across data-centre servers. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
Low-trust AI compute verification system overview A reference design that existing data centres could add: network taps hash all traffic, and air-gapped, independently sourced checkers later re-run randomly chosen records. Proposed architecture · Realises Network taps and certifiers, Sampled inference recomputation, Deterministic and bit-exact inference, Zero-knowledge proofs of inference, Memory wiping and proofs of secure erasure, Timed challenge-response and memory-occupation challenges, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for screening challenged records to show declared inference compute is not training. Medium confidence. Implementation · Adversarial prover	Published analysis or argument	This compute runs inference, not training The declared model is the one being served Declared safeguards were applied during inference Communication between compute groups is bounded	Adversarial prover
Network taps and certifiers Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.	Mechanism	Proposed Proposed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	This compute runs inference, not training Model weights have not left the facility The declared model is the one being served A training run stayed within declared limits	Adversarial prover
RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. Proposed architecture · Realises Bandwidth limits and compartmentalization, Side-channel suppression for isolated facilities Provider-reported	Implementation	Proposed Proposed for the operator's own weight security, with no outside verification described. Low confidence. Implementation · Semi-trusted prover	Published analysis or argument	Model weights have not left the facility The declared model is the one being served Communication between compute groups is bounded	Semi-trusted prover
SASH confidential network logger An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check the facility serves inference. Research prototype · Realises Network taps and certifiers, Sampled inference recomputation Provider-reported	Implementation	Proposed Proposed for telling inference from training on a mutually inspected cluster. Medium confidence. Implementation · Semi-trusted prover	No published adversarial analysis recorded	This compute runs inference, not training The declared model is the one being served	Semi-trusted prover
Side-channel suppression for isolated facilities Shielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.	Mechanism	Proposed Proposed for bounding physical covert channels out of a verified enclosure. Medium confidence. Mechanism · Adversarial prover	Published analysis or argument	Communication between compute groups is bounded Model weights have not left the facility This compute runs inference, not training	Adversarial prover

Includes records that list this as a secondary category. Claims in grey italics are supported rather than aimed at.