Claim · Positive

The declared model is the one being served

Outputs delivered to users or auditors come from the specific model, weights and configuration the provider declared, not from a substitute.

Evaluations, audits and agreements often apply to one specific model. If a provider could evaluate one model and serve another, such as a cheaper, quantized or modified version, those checks would say little about what users receive. It is a positive claim that can be tested directly, but three problems make it hard. Numerical nondeterminism means honest recomputation does not match exactly. The verifier usually cannot see the weights, which are commercially or strategically sensitive. And the evidence must come from the actual serving system rather than a separate test instance. Approaches include statistical or exact recomputation of sampled outputs, hardware attestation of the loaded weights, and zero-knowledge proofs. They trade off cost, trust in hardware vendors and confidentiality.

State of verificationeditors' synthesis

The served model can be checked directly on its outputs, and several mechanisms for it are demonstrated (R2). None is deployment-ready (R3): independent security evaluations are either missing or, for trusted execution environments, found a critical flaw.

Sampled recomputation (R2) re-runs logged outputs on a trusted copy of the model, helped by deterministic inference (R2); TOPLOC and DiFR implement it. Model identity attestation (R2) uses TEE remote attestation (R2) to show which weights an enclave loaded, as in Tinfoil model identity (Modelwrap). Zero-knowledge proofs of inference (R2), such as zkLLM, keep weights private without trusting hardware. Confidential multi-party verification (R2) binds audit results to the served model ¹⁰.

On the authors' open-weight test models, Token-DiFR detected 4-bit quantization with AUC above 0.999 within 300 output tokens ². zkLLM proves one inference of a 13-billion-parameter model in under 15 minutes ⁷.

Evidence must be tied to the production serving path, not a test instance, and recomputation needs the verifier, or an environment both sides trust, to hold the weights ⁶. Attestation rests on hardware keys: a published memory-bus attack with physical access extracted an Intel attestation key and forged attestations ¹¹. Zero-knowledge proving remains expensive ⁶.

Mechanisms

R2Attestable Auditsprimary
Users can check that the model answering them is the audited one.
R2Confidential multi-party verificationprimary
Binds audit or capability-evaluation results to the model that is served, without revealing weights ⁴ ¹.
R2Deterministic and bit-exact inferenceprimary
Enables exact-match recomputation checks that the declared model, weights and software setup produced the outputs.
R2DiFR (Divergence From Reference)primary
Checks that outputs are consistent with the declared model, precision and sampling configuration.
R2Model identity attestation⚠primary
Core purpose: responses come from the declared weights.
R2Sampled inference recomputationprimary
Checks that sampled recorded outputs are consistent with the declared model, precision and sampling settings.
R2TEE remote attestation for AI workloads⚠primary
Attests the software stack that produced responses, and the model too when paired with a weight commitment (see Model identity attestation).
R2Tinfoil model identity (Modelwrap)⚠primary
Clients check that the served weights match a committed root hash.
R2TOPLOCprimary
Checks that the provider produced outputs with the claimed model weights, prompt and precision.
R2Zero-knowledge proofs of inferenceprimary
Binds each proven output to committed weights and a public architecture.
R2zkLLMprimary
Proves an output follows from committed weights and a public architecture.
R1Attestable zero-knowledge inference proverprimary
Attestable reports proving y = F(W, x, r) for committed weights W.
R2Safeguard attestationsupporting
Property and audit attestations bind responses to a measured model ³ ⁴.
R1AI 2040 inference-only verification stacksupporting
Recomputation checks sampled packets against the declared model.
R1Hardware-enabled guarantees (flexHEG) and guarantee processorssupporting
Deployment only to approved flexHEG devices, and verification of evaluation scores ¹.
R1Low-trust AI compute verification system overviewsupporting
Screening checks that the model is on an agreed whitelist.
R1Network taps and certifierssupporting
Replaying challenged records with the declared model checks which model produced outputs ¹ ⁴.
R1RAND secure inference data center (SIDC) designsupporting
The compute sanctum checks resident weights against reference measurements before serving.
R1SASH confidential network loggersupporting
Recomputation uses another copy of the declared model ¹ ².

Why it matters

Checks on a model's capabilities or safety apply to the model that was checked. Several parties depend on that link:

Agreement verifiers. RAND's framework asks verifiers to confirm that declared inference is declared accurately, so that the prover actually did the claimed deployment ¹. It then asks them to confirm that deployed models have the required properties, for example through evaluations at regular intervals ¹. Both steps assume the evaluated model is the served model. A low-trust system overview identifies running approved models for prohibited uses as the most difficult violation to defend against, and aims to deploy only approved models ⁶. The Oxford Martin report includes appendices on model fingerprint attestation and on "device-model mating" with an encrypted model ⁵.
Customers. The DiFR authors note that providers and their customers increasingly need to verify that inference is performed correctly, without errors or tampering ². Their Token-DiFR method detected 4-bit quantization of a model with AUC above 0.999 within 300 output tokens ².

Why it is hard

Noise. Re-running the same inference often gives slightly different results because of benign numerical variation, which makes it hard to tell legitimate variation from substitution ². In LLM serving a major cause is that kernels are not invariant to batch size, which varies with server load ³. Statistical tests tolerate this noise ². Alternatively, Cankaya reports that inference can be reproduced bit-exactly across several NVIDIA GPU variants in software, given enough recorded information about the original run ⁴.
Confidentiality. Recomputation requires the weights, which a provider or state may not reveal ⁶. One system design keeps weights cryptographically committed and uses them only inside air-gapped auditing environments ⁶. Zero-knowledge proofs avoid revealing weights at all. zkLLM reports proving a full inference of a 13-billion-parameter model in under 15 minutes, with proofs under 200 kB ⁷, but the low-trust overview describes zero-knowledge proof computation as still expensive ⁶. Trusted execution environments can attest which software and data were loaded ⁹. PAL*M reports property attestation on confidential computing hardware (Intel TDX with NVIDIA H100) at under 11% overhead for common operations ⁸.
Binding. Evidence about a test instance says nothing about production unless it is tied to the serving hardware and time. The low-trust design aims to identify each forward pass uniquely and attribute it to the hardware and time it was processed ⁶. TEE-based binding relies on the vendor's keys: whoever holds the hardware's attestation key can produce valid reports, and every component that influences inference must be covered by launch measurement ⁹. A published memory-bus interposition attack, which needs physical access, extracted a per-CPU Intel attestation key and forged Intel TDX attestations ¹¹. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone before AMD's fix ¹² ¹³.

Sources

BM. Baker et al. (2025). Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment. RAND Corporation. Source recordSupports: Subgoal 1.A (declared uses declared accurately, including inference) and 1.B (required properties; deployed models evaluated at intervals) · §3.2
BA. Karvonen et al. (2025). DiFR: Inference Verification Despite Nondeterminism. arXiv. Source recordSupports: need to verify inference; nondeterminism; Token-DiFR detects 4-bit quantization with AUC > 0.999 within 300 tokens · abstract
CH. He & Thinking Machines Lab (2025). Defeating Nondeterminism in LLM Inference. Thinking Machines Lab: Connectionism. Source recordSupports: batch-size dependence as a cause of inference nondeterminism · batch invariance section
BN. Cankaya (2026). Bit-Exact AI Inference Verification Without Performance Tradeoffs. ICML 2026 Workshop on Technical AI Governance Research. Source recordSupports: bit-exact reproduction across GPU variants given recomputation data · abstract
BB. Harack et al. (2025). Verification for International AI Governance. Oxford Martin AI Governance Initiative. Source recordSupports: model fingerprint attestation; device-model mating with an encrypted model · Appendix K (p. 157); Appendix L.4 (p. 159)
BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: whitelisted models for blacklisted uses; attributing forward passes to hardware and time; committed weights in auditing environments; ZKP cost · verification goals; architecture; open problems
AH. Sun et al. (2024). zkLLM: Zero Knowledge Proofs for Large Language Models. 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS 2024). Source recordSupports: zkLLM proves 13B-parameter inference in under 15 minutes with proofs under 200 kB, keeping parameters private · abstract
BP. Chantasantitam et al. (2026). PAL*M: Property Attestation for Large Generative Models. arXiv. Source recordSupports: property attestation on Intel TDX + NVIDIA H100 with under 11% overhead for common operations · abstract
CGloria Z (2026). On TEEs for Privacy-Preserving Monitoring in AI Governance. MIRI Technical Governance Team. Source recordSupports: attestation-key holder can produce valid reports; side-channel and physical attacks; measurement coverage · Limitations
BC. Schnabl et al. (2025). Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments. ICML 2025 Workshop on Technical AI Governance. Source recordSupports: attestation linking model, audit result, prompt and response in a TEE · abstract; inference protocol
AJ. Chuang et al. (2026). TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition. 2026 IEEE Symposium on Security and Privacy (SP). Source recordSupports: physical memory-bus interposition extracts a per-CPU Intel attestation key and forges TDX attestations · abstract; §1.1
AJ. De Meulemeester et al. (2026). Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing. 47th IEEE Symposium on Security and Privacy (S&P 2026). Source recordSupports: Battering RAM forges SEV-SNP attestation with a DDR4 interposer
AB. Schlüter & S. Shinde (2025). RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP. 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25). Source recordSupports: RMPocalypse forges SEV-SNP attestation from a malicious hypervisor