# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-08. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0002,M-0014,M-0017&chips=existing

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's readiness and open flaws. Readiness levels R0 to R4 describe one record's public evidence for its assessed use and are never combined. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and flaws) and https://trustbutveri.fyi/about/readiness/ (readiness levels).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

- **Chips: Existing chips only.** "Existing chips only" removes mechanisms that need changes to future chip designs. New chip features take years to reach a deployed fleet and cover only chips made after they ship. Mechanisms that use shipping features, such as trusted execution environments or performance counters, stay.

23 of 25 mechanisms on the map pass these filters.

## Overview

One row per mechanism, read from its record. Open flaws: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees.

| Mechanism | Readiness | Prover | Attack testing | Hardware | Open flaws | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Deterministic and bit-exact inference | R3 | Adversarial | Analysis | None | 0 / 1 / 1 | depends | depends | not involved |
| Bandwidth limits and compartmentalization | R2 | Adversarial | Analysis | Retrofit device | 0 / 5 / 0 | not involved | not involved | not involved |
| Tamper evidence for verifier devices | R2 | Adversarial | Analysis | Retrofit device | 0 / 3 / 0 | not involved | not involved | not involved |

## Claims

No claims chosen.

## Mechanisms

### Deterministic and bit-exact inference

Making model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately. ([Deterministic and bit-exact inference](https://trustbutveri.fyi/mechanisms/deterministic-inference/))

- Assessment: mechanism family.
- Readiness: R3 In production, assessed for reproducing open-model inference from receipts in Gensyn's information-market service.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: none. Prover cooperation: required. Attack testing: analysis. Category: Cryptographic & computational.
- What the verifier sees: model weights depends; inputs and outputs depends; training data not involved. Exact replay needs the weights, configuration and replayed requests inside the recomputation environment. What the verifier sees depends on whether that environment keeps them confidential.

### Bandwidth limits and compartmentalization

Capping or removing network links between groups of accelerators, so that serving within each group still works but large training across groups becomes far slower. ([Bandwidth limits and compartmentalization](https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/))

- Assessment: mechanism family.
- Readiness: R2 Demonstrated, assessed for monitoring inter-node traffic with operator-run software on four GPUs.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: required. Attack testing: analysis. Category: Isolation & system architectures.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Caps traffic between groups of chips; it does not read the traffic's content.

### Tamper evidence for verifier devices

Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating. ([Tamper evidence for verifier devices](https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/))

- Assessment: mechanism family.
- Readiness: R2 Demonstrated, assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: partial. Attack testing: analysis. Category: Off-chip devices & sensors.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Protects verifier devices; it does not handle model data.


## Properties

**In production**

- Deterministic and bit-exact inference: R3 In production, assessed for reproducing open-model inference from receipts in Gensyn's information-market service

**Built for an adversarial prover**

- Deterministic and bit-exact inference
- Bandwidth limits and compartmentalization
- Tamper evidence for verifier devices

**No new hardware needed**

- Deterministic and bit-exact inference


## Attack testing

Published attempts to break a system, including those that found failures. Testing history does not establish that open flaws are resolved.

**Testing history**

- Deterministic and bit-exact inference: Analysis
- Bandwidth limits and compartmentalization: Analysis
- Tamper evidence for verifier devices: Analysis


## Limits

**Open significant flaws**

- Cross-hardware replay relies on reverse-engineered, closed behaviour (open question, in Deterministic and bit-exact inference; https://trustbutveri.fyi/mechanisms/deterministic-inference/#flaw-2) [1][3]. Emulating one GPU's rounding on another requires reverse-engineering tensor-core arithmetic and modelling proprietary kernel choices. Hawkeye covers a subset of NVIDIA architectures and states that attention and other higher-level operations need further reverse engineering. For the bit-exact emulator, a proprietary Hopper kernel family is an open edge case.
- Low-communication training reduces the bandwidth training needs (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-1) [13][16][17]. DiLoCo matched fully synchronous training on 8 workers while communicating 500 times less. Rahman writes that this family of methods theoretically allows large-scale training with less than 100 Mbps. Lucid includes these methods in its bounds, but notes that extreme activation compression, architectures with unusually small inter-layer widths, or modular paradigms could erode the margin.
- Operator control of pod routing collapses the bound (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-2) [13]. Lucid's analysis finds that if the operator can freely assign pods to routers, it could dedicate a whole cell of 100 or more pods to one pipeline stage. The bound then falls to about 90–220x uncompressed and as low as about 25x with compression. The proposed mitigation, auditor-controlled random assignment that is periodically re-randomized, has not been implemented.
- Undeclared local storage raises per-pod capacity (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-3) [13]. More memory or storage per pod helps an adversary. Lucid requires per-pod storage to be declared, capped and physically inspected.
- Training within one pod is not covered (open question, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-4) [13]. Lucid's bounds concern pre-training models larger than the pods are sized for. Training models that fit in one pod, fine-tuning and reinforcement-learning post-training within one pod are outside the modelled threat.
- Parallel scale-up switches are hard enforcement points (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-5) [15]. In GB200 topologies, GPUs reach GPUs in other nodes through NVSwitches without a NIC on the path. Amodo notes that limits are hard to enforce there because many switches work in parallel, so compromising one or two would bypass the limit.
- Seals are often defeated with simple methods (demonstrated attack, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/#flaw-1) [24][25]. Mechanism-class evidence. Published defeats of general security seals. They warn about proposed verifier-device seals, but do not demonstrate defeat of an AI verification enclosure or sensor. In 1996 a Los Alamos vulnerability assessment defeated all 94 security seals it examined, with 132 defeats in total, using rapid, inexpensive, low-tech methods. It found that seal cost did not predict security. In 2001 Johnston reported that high-tech seals are often easier to defeat than low-tech ones.
- Security depends on inspection protocols (theoretical argument, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/#flaw-2) [23][25]. Mechanism-class evidence. An inspection and protocol requirement drawn from safeguards and enclosure studies, not a reported break of a deployed AI verifier. Johnston argues that a seal is no better than the protocols for using it, and that inspectors are usually given little useful information on how to detect tampering. The Sandia survey notes that larger enclosures are hard to inspect fully and that sensor data must be authenticated.
- Attack classes outside published models (open question, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/#flaw-3) [18][19][26]. Mechanism-class evidence. The radio compensation result is emulated using measured channel data under a known-reference attacker model. It is not a physical bypass demonstration against an AI verifier enclosure. The authors of the batteryless cover say they cannot assess chemical-solvent attacks, which exceed their expertise, and deem cover removal impractical. Anti-Tamper Radio's reference can drift as the environment or measurement system ages; the authors suggest gradually renewing the reference. A 2025 follow-up by some of the same authors shows, by emulation on measured channel data, that an attacker who knows the reference channel and the needle's effect on it could inject a signal that cancels the change caused by a needle insertion. It proposes a reconfigurable intelligent surface that randomizes the channel as a countermeasure.

**Open minor flaws**

- Some kernels remain genuinely nondeterministic (open question, in Deterministic and bit-exact inference; https://trustbutveri.fyi/mechanisms/deterministic-inference/#flaw-1) [1]. The bit-exact work separates kernels that are deterministic but not batch-invariant from truly nondeterministic ones that use atomic functions. Some integer de-quantization kernels use atomic additions and remain nondeterministic, so exact replay needs backends that avoid them.


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open flaw or a dependency. Pointers, not recommendations: each brings its own readiness level and flaws, and none is claimed to close a flaw.

- **Network taps and certifiers** (R1 Proposed, assessed for committing a complete record of cluster traffic, so declared inference can be checked)
  - Bandwidth limits and compartmentalization waits on it: The verifier must know that all traffic leaving a pod crosses the capped, monitored links.


## Dependencies

**Blockers**

- Deterministic and bit-exact inference: Batch-invariant kernels cost throughput: in Thinking Machines' Qwen3-8B test, an improved deterministic build took 42 s against 26 s for vLLM's default, and SGLang reports an average 34.35% slowdown on its FlashInfer and FlashAttention 3 backends. (performance & compatibility) [2][4]
- Deterministic and bit-exact inference: Coverage is incomplete: the bit-exact emulator targets dense blocks on NVIDIA GPUs and excludes mixture-of-experts inference and training, and vLLM's batch-invariant mode is in beta, with open work on AMD hardware and speculative decoding. (performance & compatibility) [1][5][27]
- Deterministic and bit-exact inference: Amodo's status page for the AI 2040 verification plan rates a reproducible inference stack for that plan as 'not started'. (performance & compatibility) [28]
- Deterministic and bit-exact inference: Exact replay requires the prover to disclose weights, software versions, parallelism and batch sizes to whoever recomputes. (privacy & leakage) [1][11]
- Bandwidth limits and compartmentalization: No cap that a verifier can check has been implemented or red-teamed. (adversarial validation) [13]
- Bandwidth limits and compartmentalization: The verifier must know that all traffic leaving a pod crosses the capped, monitored links. (coverage & hidden compute; waits on Network taps and certifiers) [11]
- Bandwidth limits and compartmentalization: Shaping devices and routing assignments must be trusted by both parties; Amodo has not yet fully analysed resilience to a compromised DPU. (hardware trust; waits on Tamper evidence for verifier devices) [13][15]
- Bandwidth limits and compartmentalization: Advances in low-communication training could shrink the margin that the cap enforces. (capacity bounds) [13][16][17]
- Tamper evidence for verifier devices: No tamper-evident enclosure has been designed for AI verifier hardware at retrofit scale. (hardware trust) [11]
- Tamper evidence for verifier devices: Battery-backed designs add bulk, limit operating temperature (+10 °C to +35 °C for the IBM 4765) and complicate transport. (performance & compatibility) [19]
- Tamper evidence for verifier devices: Active monitoring needs power, and visual inspection of large enclosures faces access limits. (access & governance) [23]
- Tamper evidence for verifier devices: No evaluation has been published in the AI verification setting. (adversarial validation) [11]


## What the verifier sees

- Model weights: shown by none; depends on the design for Deterministic and bit-exact inference; hidden by none; not involved in Bandwidth limits and compartmentalization and Tamper evidence for verifier devices; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for Deterministic and bit-exact inference; hidden by none; not involved in Bandwidth limits and compartmentalization and Tamper evidence for verifier devices; unspecified for none.
- Training data: shown by none; depends on the design for none; hidden by none; not involved in Deterministic and bit-exact inference, Bandwidth limits and compartmentalization and Tamper evidence for verifier devices; unspecified for none.

## Implementations

- Deterministic and bit-exact inference: [Batch-invariant inference kernels (Thinking Machines)](https://trustbutveri.fyi/implementations/batch-invariant-inference-kernels/) (R2, open-source project); [Verde and RepOps (Gensyn)](https://trustbutveri.fyi/implementations/gensyn-verde-repops/) (R3, product); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture)
- Bandwidth limits and compartmentalization: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [RAND secure inference data center (SIDC) design](https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/) (R1, proposed architecture)
- Tamper evidence for verifier devices: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture)

## Sources

1. Bit-Exact AI Inference Verification Without Performance Tradeoffs, N. Cankaya (2026). https://arxiv.org/abs/2606.00279
2. Defeating Nondeterminism in LLM Inference, H. He & Thinking Machines Lab (2025). https://thinkingmachines.ai/blog/defeating-nondeterminism-in-llm-inference/
3. Hawkeye: Reproducing GPU-Level Non-Determinism, E. Badash et al. (2026). https://proceedings.mlsys.org/paper_files/paper/2026/hash/e217c271a57c365a246b0ad39e668ba8-Abstract-Conference.html
4. Towards Deterministic Inference in SGLang and Reproducible RL Training, The SGLang Team (2025). https://www.lmsys.org/blog/2025-09-22-sglang-deterministic/
5. Batch Invariance (vLLM documentation), vLLM project (2026). https://github.com/vllm-project/vllm/blob/main/docs/features/batch_invariance.md
6. gensyn-ai/ree: Gensyn Reproducible Execution Environment (GitHub repository), Gensyn (2026). https://github.com/gensyn-ai/ree
7. EigenCloud Brings Verifiable AI to Mass Market with EigenAI and EigenCompute Launches, EigenCloud (2025). https://www.eigenlabs.org/blog/eigencloud-brings-verifiable-ai-to-mass-market-with-eigenai-and-eigencompute-launches/
8. Building Delphi: Pricing, Settlement, and Agentic Trading, D. Jedamski (2026). https://www.gensyn.ai/blog/building-delphi-pricing-settlement-and-agentic-trading
9. Reproducible Execution Environment (REE) (Gensyn documentation), Gensyn (2026). https://docs.gensyn.ai/tech
10. What is Delphi? (Delphi documentation), Gensyn (2026). https://docs.delphi.fyi/
11. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
12. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
13. Traffic Shaping for Workload Classification, Lucid Computing (2026). https://lucidcomputing.substack.com/p/traffic-shaping-for-workload-classification
14. De-risking Interconnect Limits for AI Verification, A. Scher et al. (2026). https://techgov.intelligence.org/blog/de-risking-interconnect-limits-for-ai-verification
15. The Tray as a Bandwidth Boundary, Amodo Design (2026). https://amododesign.com/notes/2026-03-16-dpu-bandwidth-limiter/
16. DiLoCo: Distributed Low-Communication Training of Language Models, A. Douillard et al. (2024). https://arxiv.org/abs/2311.08105
17. Does Distributed Training Undermine Compute Governance?, R. Rahman (2026). https://arxiv.org/abs/2605.29359
18. Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems, P. Staat et al. (2022). https://ieeexplore.ieee.org/document/9833631/
19. Secure Physical Enclosures from Covers with Tamper-Resistance, V. Immler et al. (2019). https://tches.iacr.org/index.php/TCHES/article/view/7334
20. ImpedanceVerif: On-Chip Impedance Sensing for System-Level Tampering Detection, T. Mosavirik et al. (2023). https://eprint.iacr.org/2022/946
21. IBM 4765 Cryptographic Coprocessor Security Module: Security Policy, IBM Corporation (2012). https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp1505.pdf
22. PHYSEC SEAL: Change detection for maximum safety, PHYSEC GmbH (2026). https://www.physec.de/en/solutions/physec-seal/
23. Tamper-Indicating Enclosures, A Current Survey, H. A. Smartt & Z. N. Gastelum (2015). https://www.osti.gov/servlets/purl/1256541
24. Physical Security and Tamper-Indicating Devices, R. G. Johnston & A. R. E. Garcia (1996). https://www.osti.gov/servlets/purl/459707
25. Tamper Detection for Safeguards and Treaty Monitoring: Fantasies, Realities, and Potentials, R. G. Johnston (2001). https://www.nonproliferation.org/wp-content/uploads/npr/81john.pdf
26. Anti-Tamper Radio Meets Reconfigurable Intelligent Surface for System-Level Tamper Detection, M. S. Tabar et al. (2025). https://arxiv.org/abs/2503.14279
27. [Feature]: Batch Invariant Feature and Performance Optimization (vLLM issue #27433), vLLM project contributors (2025). https://github.com/vllm-project/vllm/issues/27433
28. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). https://amododesign.com/ai-verification/plan-a-sitrep/