Claims
A claim is something one party wants to verify about another party's AI hardware or software, such as "this cluster only runs inference".
Compute stock is at most a declared amount
A party holds no more AI-relevant compute, counted in chips or equivalent capacity, than the total it has declared.
State of verification
- Chip registries and manufacturing records
Proposed
Proposed for a checkable record of which chips were made and who declared owning them. Medium confidence.
Chips are where they are declared to be
Specific AI chips are physically located at the sites a party has declared, throughout the declared period.
State of verification
Chip location concerns known devices and can be checked by locating each one, so it is one of the more tractable claims, but every publicly described scheme is still proposed (R1).
- Chip location verification
Proposed
Proposed for bounding how far a chip is from trusted landmark servers when checked. Medium confidence.
- Lucid sovereignty (location) certificates
Proposed
Proposed for certifying the region where an attested workload ran at a given time. Medium confidence.
Declared hardware is idle or shut down
Specified AI chips or facilities are not performing computation, or are powered off, throughout a declared period.
State of verification
Idleness is one of the more approachable negative claims, because computing needs power and leaves physical traces. On-chip telemetry and timed challenges have reached research demonstration (R2) as indicators of GPU activity, not as proofs that all declared hardware is idle.
- GPU contention probes Draft
Research demo
Research demonstration for detecting another workload running on the same GPU. Medium confidence.
- On-chip telemetry from timing, memory and performance counters
Research demo
Research demonstration for workload evidence from GPU counters and timing, assuming authentic measurements. Medium confidence.
- Timed challenge-response and memory-occupation challenges
Research demo
Research demonstration for detecting whether a GPU is doing other work. Medium confidence.
This compute runs inference, not training
A declared cluster is used only to run existing models to produce outputs, and not to train new or more capable models.
State of verification
Declared inference can be checked with components at research demonstration (R2). Sampled recomputation and deterministic inference are in production (R3) for checking untrusted inference providers. No production use for a declared cluster is documented. Ruling out training cannot yet be verified, because it needs the rest of the cluster accounted for. Full-stack designs that would do so (AI 2040 inference-only verification stack, Low-trust AI compute verification system overview, SASH confidential network logger) are proposed (R1). The Amodo team, which is building verification components, reports that none of the core components is past a proof-of-principle prototype 13.
- On-chip telemetry from timing, memory and performance counters
Research demo
Research demonstration for workload evidence from GPU counters and timing, assuming authentic measurements. Medium confidence.
- Workload classification from telemetry and side channels
Research demo
Research demonstration for telling training from inference and other work using genuine telemetry, including disguised workloads. Medium confidence.
- AI 2040 inference-only verification stack
Proposed
Proposed for showing that retrofitted data centres run only inference. Medium confidence.
- Low-trust AI compute verification system overview
Proposed
Proposed for screening challenged records to show declared inference compute is not training. Medium confidence.
- SASH confidential network logger
Proposed
Proposed for telling inference from training on a mutually inspected cluster. Medium confidence.
- Whole-workload recomputation (reproducible packets)
Proposed
Proposed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence.
The declared model is the one being served
Outputs delivered to users or auditors come from the specific model, weights and configuration the provider declared, not from a substitute.
State of verification
The served model can be checked directly on its outputs, and several mechanisms for it have reached research demonstration (R2) or operational use (R3). These development statuses are separate from security evidence and do not show that a mechanism is secure. Known attacks and limits each hold under their own conditions. Forging Intel TDX attestations through the memory bus needed physical access to the hardware 13, but another attack forged AMD SEV-SNP attestations from a malicious hypervisor, in software alone, on platforms without AMD's fix 15. One statistical test of API outputs reached a median power of 77.4% against a range of distortions, using an average of 10 samples per prompt 16. Power here is the probability that the test detects a specified change to the model under the tested conditions 16.
- Hardware-attested weight binding⚠
Operational use
Operational use for showing users, through hardware attestation, that a service runs its committed weights. Medium confidence.
- Sampled inference recomputation
Operational use
Operational use for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence.
- Tinfoil model identity (Modelwrap)⚠
Operational use
Operational use for showing clients that the served weights match a committed hash. Medium confidence.
- TOPLOC
Operational use
Operational use for checking that untrusted providers used the claimed model, prompt and precision. Low confidence.
- Verde and RepOps (Gensyn)
Operational use
Operational use for reproducing declared-model inference from receipts in Gensyn's information-market service. Low confidence.
- Attestable Audits
Research demo
Research demonstration for attesting a benchmark audit run on a confidential model in an enclave. Low confidence.
- Confidential multi-party verification
Research demo
Research demonstration for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence.
- DiFR (Divergence From Reference)
Research demo
Research demonstration for checking that outputs match the declared model, precision and sampling settings. Medium confidence.
- EZKL
Research demo
Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence.
- PAL*M Draft
Research demo
Research demonstration for attesting declared model operations on a confidential CPU–GPU prototype. Medium confidence.
- Zero-knowledge proofs of inference
Research demo
Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence.
- zkLLM
Research demo
Research demonstration for proving an output came from committed weights, against a prover who cheats. Medium confidence.
- Attestable zero-knowledge inference prover
Proposed
Proposed for proving an output came from committed weights. Low confidence.
Declared safeguards were applied during inference
Specified safety measures, such as input filters, output checks or monitoring, actually ran on the requests a deployed model served.
State of verification
Safeguard application has been shown only in small research prototypes, which can show that a declared safeguard ran, not that it works.
- Safeguard attestation
Research demo
Research demonstration for attesting that a declared safeguard mediated a service's responses. Low confidence.
A training run stayed within declared limits
A declared training run used no more compute than permitted and had its declared properties, such as training data, settings and resulting weights.
State of verification
Proof-based checks of training remain far below frontier-scale runs. Proof-of-learning and zero-knowledge proofs of training have both reached research demonstration (R2); hardware enforcement remains proposed (R1).
- Kaizen Draft
Research demo
Research demonstration for proving gradient-descent training of small image models on committed data. Medium confidence.
- Training-transcript verification (proof-of-learning)⚠
Research demo
Research demonstration for checking from its transcript that a training run followed declared rules. Medium confidence.
- VeriLoRA Draft
Research demo
Research demonstration for proving single-sample LoRA fine-tuning steps for 3–13-billion-parameter language models. Medium confidence.
- Zero-knowledge proofs of training constraints
Research demo
Research demonstration for proving a training run followed a committed specification and data. Medium confidence.
- Hardware-enabled guarantees (flexHEG) and guarantee processors
Proposed
Proposed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence.
Communication between compute groups is bounded
Data flowing between specified groups of chips, or out of a facility, stays below a declared rate.
State of verification
A software bandwidth monitor has reached research demonstration (R2). It runs on the operator's nodes, and its authors say the measurements are trivially spoofable 13. No bandwidth cap that a verifier can check has been demonstrated publicly.
- Bandwidth limits and compartmentalization
Research demo
Research demonstration for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence.
- Side-channel suppression for isolated facilities
Proposed
Proposed for bounding physical covert channels out of a verified enclosure. Medium confidence.
Model weights have not left the facility
No copy of specified model weights has left a designated facility through networks, physical media or other channels.
State of verification
Only the network channel has a bound at research demonstration (R2), and only for inference outputs. Physical side channels rely on proposed (R1) designs, and insiders and physical media are left to facility security 1 and personnel measures such as whistleblowing 8.
- Bounding unexplained information in outputs
Research demo
Research demonstration for bounding how much hidden information can leave in checked inference outputs. Low confidence.
There is no undeclared relevant compute
A party controls no AI-relevant computing hardware or facilities, above an agreed threshold, beyond those it has declared.
State of verification
This claim concerns undeclared clusters. No single verification method is foolproof for this broadest of negative claims 5, so draft agreements pair technical measures with intelligence, challenge inspections and whistleblowers 6. The only mechanism mapped primarily to this claim, remote detection of data centres, is proposed (R1), as are the chip registries and location checks that support it. The broader goal in RAND's verification framework also covers undeclared use of declared clusters, which reduces to claims such as idle declared hardware and inference, not training 1.
- Remote detection of data centres
Proposed
Proposed for finding undeclared data centres above an agreed compute threshold. Medium confidence.
The declared evaluation was run
The reported test result comes from running the agreed evaluation procedure on the specified model and test data.
State of verification
Evaluation integrity means that the declared model, test data and procedure produced the reported result. Attestable Audits describes that binding explicitly 1. PAL*M includes evaluation among its attested operations 2. Cove chains reviewed, attested workflow stages, each certifying its inputs and outputs 3. These checks depend on the measured software and the hardware attestation roots. PySyft's double-blind pilot adds practical evidence for confidential evaluation, with participant-accepted opaque code and cloud verification assumptions 4. An accepted result still needs an interpretation of what the evaluation measures. A later deployment needs its own link to the evaluated model.
- Attestable Audits
Research demo
Research demonstration for attesting a benchmark audit run on a confidential model in an enclave. Low confidence.
- Confidential multi-party verification
Research demo
Research demonstration for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence.
- Cove Draft
Research demo
Research demonstration for composing owner-approved confidential workflow stages on Intel TDX. Medium confidence.
- PAL*M Draft
Research demo
Research demonstration for attesting declared model operations on a confidential CPU–GPU prototype. Medium confidence.
- PySyft double-blind evaluations
Research demo
Research demonstration for evaluating a private model on private prompts, neither party seeing the other's inputs. Medium confidence.