Claim · Mixed

This compute runs inference, not training

On this page

Mechanisms

R2 On-chip telemetry from timing, memory and performance counters ⚠primary
Classifying training versus other workloads from counters ³ or timing ¹.
R2 Workload classification from telemetry and side channelsprimary
Classifies observed activity as training, inference or non-ML work.
R1 Network taps and certifiersprimary
Supplies the committed record of cluster I/O that recomputation checks against declared inference ¹ ⁴.
R1 Proofs of useful work for capacity accountingprimary
Bounds the spare capacity of declared hardware that could run unauthorised training; Attestable pairs work accounting with ZK inference proofs.
R1 Whole-workload recomputation (reproducible packets)primary
Proposed as the correctness check for an inference-only retrofit ¹.
R3 Deterministic and bit-exact inferencesupporting
Bit-exact recomputation of declared inference removes the tolerance an operator could hide other work in ¹.
R3 Sampled inference recomputationsupporting
Proposed as the correctness check in inference-only retrofit plans. Completeness needs other mechanisms ³ ⁶.
R3 TEE remote attestation for AI workloads ⚠supporting
Attests a declared inference deployment, but not that the same chips ran no other workloads ¹¹.
R2 Bandwidth limits and compartmentalizationsupporting
Intended to leave inference workable while making large training impractical ¹ ².
R2 Bounding unexplained information in outputssupporting
In the compute-agreement framing, outputs must be predictable by policy-compliant computation, which limits what undeclared workloads can export ¹.
R2 Tamper evidence for verifier devicessupporting
Protects the integrity of taps, gateways and recomputation hardware used for inference-only verification ¹² ¹³.
R2 Timed challenge-response and memory-occupation challengessupporting
Listed as an alternative inference-verification direction that may not need a hardware retrofit ²; bounds spare memory ¹.
R2 Zero-knowledge proofs of inferencesupporting
Attestable proposes using proofs to show accounted workloads used an approved, unchanged model.
R1 Memory wiping and proofs of secure erasuresupporting
Periodic wipes are proposed so that only verified inference outputs persist ¹; Amodo frames wipes as verifying completeness of declared workloads ⁵.
R1 Side-channel suppression for isolated facilitiessupporting
Inference-only designs count on suppressing unmonitored physical channels so that all significant traffic passes the taps ².

Implementations

R1 AI 2040 inference-only verification stackprimary
Assessed use: showing that retrofitted data centres run only inferenceThe stack's stated purpose: retrofitted data centres run only inference.
R1 Data-centre memory challengingprimary
Assessed use: confirming data presence and bounding free memory across data-centre serversA capacity-filling challenge bounds the free memory a hidden workload would need ¹.
R1 Low-trust AI compute verification system overviewprimary
Assessed use: screening challenged records to show declared inference compute is not trainingChallenged records are screened for inference versus training.
R1 SASH confidential network loggerprimary
Assessed use: telling inference from training on a mutually inspected clusterSASH describes the aim as distinguishing inference from training in data centres ¹.
R3 Pearl proof-of-useful-work blockchainsupporting
Assessed use: checking matrix-multiplication work proofs for blockchain consensusDemonstrates matrix-multiplication work proofs, a component proposed for capacity accounting ⁸; Pearl has not demonstrated that use.
R1 Attestable zero-knowledge inference proversupporting
Assessed use: proving an output came from committed weightsProposed use: showing an accounted workload used an approved, unchanged model.