Evidence binding

Evidence binding ties a piece of verification evidence to the device, workload, data and time it describes, so that it cannot be replayed, substituted or attributed to something else ^{1 2}.

The IETF remote-attestation architecture states the requirement for devices: evidence must be securely associated with the environment it describes, so that a verifier cannot be tricked into accepting claims that originate elsewhere ¹. Binding has several dimensions:

• Device. Evidence is signed with key material held by the attesting device, as in TEE remote attestation ¹; Scher and Thiergart note that if a chip's private key were extracted, other chips could impersonate it and spoof its location ³.
• Time. A nonce from the appraising party, signed into the evidence, shows that it is fresh rather than replayed ¹, and network taps hash and timestamp the traffic they capture ⁴.
• Workload. Shavit's design has chip firmware hash and sign weight snapshots taken at random times ⁵, and one low-trust system aims to identify each forward pass uniquely and attribute it to the hardware and time that processed it ².
• Model and data. PAL*M tracks dataset integrity with incremental multiset hashing inside confidential virtual machines, so that attested properties refer to the model and data actually used ⁶.

Binding also constrains when evidence is fixed: for sampled checks, the prover must commit to its records before it learns which ones will be audited ⁷.