The claim is that no copy of specified model weights has left a designated facility through networks, physical media or other channels.
Agreements and security commitments may require this, for example against theft by well-resourced attackers. Verification equipment could itself leak the prover's secrets. The claim is negative and covers every channel, including people and physical side channels.
Approaches include checking that outgoing traffic is explained by legitimate computation so that hidden data stands out, capping the bandwidth of external links, suppressing side channels, and physical security with inspection. At best they bound how much could leave. In one test with benign prompts, checking inference outputs against a reference reduced hidden data below 0.5% of the outputs' theoretical capacity, slowing exfiltration over 200 times.
An independent six-model study found slowdowns of 146–254 times with benign prompts but 60–118 times with attacker-chosen prompts. Physical and insider channels remain harder to bound.
Only the network channel has a bound at research demonstration (R2), and only for inference outputs. Physical side channels rely on proposed (R1) designs, and insiders and physical media are left to facility security 1 and personnel measures such as whistleblowing 8.
For example, a verifier may want to know that a facility serving a model through an API has not let the weights out inside its responses.
- Network taps (R1) record what the facility sends, and sampled recomputation re-runs sampled requests on a trusted copy of the model with the same random seed 2. Bounding unexplained information (R2) then scores how plausible each returned token is under honest sampling, which bounds how fast hidden bits can pass unnoticed 2.
- Rinberg and colleagues published code for this check. On a 30-billion-parameter model under benign prompts, it cut the information an attacker could hide to under 0.5% of the outputs' theoretical capacity, at a false-positive rate below 0.01%, which the authors equate to slowing an attacker over 200 times 2 3.
- This establishes a rate limit on one channel, not that no copy left. In an independent study across six models, an attacker who controlled the prompts roughly doubled the leak per token, cutting the slowdown from 146–254 times under benign prompts to 60–118 times 4. Extrapolating the benign-prompt result of about 0.1 bits per token, one cluster I/O fingerprinting design estimates about 40 Mbit/s of covert output for a fully loaded 200,000-GPU inference cluster 13. Deterministic inference would remove the tolerance that hidden data exploits 11.
- The bound holds only if checked outputs are the only way out. Caps on external bandwidth limit the total that can leave 10 14. Side-channel suppression (R1) is designed to hold physical leakage to a few kilobits per second, not to zero 7. RAND's secure inference data centre (R1) is designed to protect weights against state-backed attackers but does not describe how an outside party would verify it 12.
On this page
Why it matters
Model weights are a primary target for theft 1.
- In a study on securing model weights, RAND researchers write that protecting frontier models from theft and misuse will become more important as they grow more capable 1. They identify 38 distinct attack vectors, and define five security levels for defending against actors ranging from opportunistic criminals to well-resourced nation-states 1.
- For verifying international agreements, Scher and Thiergart describe one approach as using strong security to prevent model weights from leaving a data centre, and then monitoring that data centre closely 5.
- RAND's verification framework treats confidentiality, meaning protection of models, data and code from unauthorised access and especially theft, as a requirement on verification 8. A low-trust system overview assumes the verifier may try to exfiltrate the prover's secrets 6. It therefore sends only cryptographic commitments out of the facility, and checks challenged data only in an auditing environment inside the prover's facility 6.
Why it is hard
The claim must hold for every channel. The RAND weight-security study's 38 attack vectors span far more than network transfer 1.
- Hidden data in ordinary outputs. An attacker who controls an inference server could hide weights inside ordinary model responses using steganography 2. Rinberg and colleagues formalise this as a security game and verify outputs against a reference 2. On a 30-billion-parameter mixture-of-experts model, their detector reduced exfiltratable information to under 0.5% of the outputs' theoretical capacity at a false-positive rate below 0.01%, which they equate to a slowdown of more than 200 times for an adversary 2 3. An independent study across six models found that an attacker who chooses the prompts roughly doubles the bits leaked per token, cutting the slowdown from 146–254 times under benign prompts to 60–118 times 4.
- Capping egress. In an Alignment Forum post on upload limits, Greenblatt proposes limiting the total data uploaded from inference servers, so that an attacker who compromises them still cannot move out the weights 14. In a 2026 paper on language-model compression, Rinberg and colleagues restate the rationale: if only 10 GB leaves a data centre, an adversary cannot steal more than 10 GB 10. Bounding a facility's links in this way is the subject of the bandwidth claim.
- Explaining all egress. Making all egress traffic explainable by its ingress is an open design question, including which engineering compromises it would require 6. Active network taps on front-end links could scrub headers to reduce covert channels 9.
- Physical side channels. These offer routes around network monitoring altogether. Proposed defences include shielding, jamming, inspection and filtering 7, with a design target of kilobits per second rather than zero 6. Residual copies in memory are addressed by memory wiping 6.
- Insiders and physical media. These are outside the reach of network-level mechanisms. RAND's verification framework includes whistleblower programmes and personnel interviews among its layers 8, and the weight-security study treats defence as requiring comprehensive measures rather than isolated ones 1.