# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-09. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0023,M-0008,M-0013&chips=existing

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's development status, security evidence and findings. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and findings) and https://trustbutveri.fyi/about/readiness/ (development status).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

- **Chips: Existing chips only.** "Existing chips only" removes mechanisms that need changes to future chip designs. New chip features take years to reach a deployed fleet and cover only chips made after they ship. Mechanisms that use shipping features, such as trusted execution environments or performance counters, stay.

23 of 25 mechanisms on the map pass these filters.

## Overview

One row per mechanism, read from its record. Open failures: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees. Findings are grouped as known failures, scope limitations and open questions. Only known failures count as failures. Counts are an inventory of published findings, not a risk score.

| Mechanism | Development | Security evidence | Prover | Attack testing | Hardware | Open failures | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Safeguard attestation | Research demonstration | Published security analysis | Semi-trusted | Analysis | Existing features | 0 / 2 / 0 | depends | depends | not involved |
| TEE remote attestation for AI workloads | Operational use | Published attack testing | Semi-trusted | Independent red-team | Existing features | 2 / 3 / 0 | hidden | hidden | hidden |
| Network taps and certifiers | Proposed | Published security analysis | Adversarial | Analysis | Retrofit device | 0 / 2 / 0 | depends | depends | depends |

## Claims

No claims chosen.

## Mechanisms

### Safeguard attestation

Hardware-signed evidence that an AI service sent a given response through its declared safeguard path, such as a wrapper that calls a guardrail classifier. ([Safeguard attestation](https://trustbutveri.fyi/mechanisms/safeguard-attestation/))

- Assessment: mechanism family.
- Development: Research demonstration (legacy code R2), assessed for attesting that a declared safeguard mediated a service's responses.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: required. Attack testing: analysis. Category: Cryptographic & computational.
- What the verifier sees: model weights depends; inputs and outputs depends; training data not involved. The enclave route signs hashes of the safeguard, request and response; a low-trust design has the verifier re-run and screen sampled requests itself.

### TEE remote attestation for AI workloads

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with. ([TEE remote attestation for AI workloads](https://trustbutveri.fyi/mechanisms/tee-remote-attestation/))

- Assessment: mechanism family.
- Development: Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware.
- Security evidence: Published attack testing. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: required. Attack testing: independent red-team. Category: On-chip & hardware-enabled.
- What the verifier sees: model weights hidden; inputs and outputs hidden; training data hidden. The enclave keeps what runs inside it from the host and the verifier; the verifier sees signed measurements. This relies on the chip vendor's hardware.

### Network taps and certifiers

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work. ([Network taps and certifiers](https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/))

- Assessment: mechanism family.
- Development: Proposed (legacy code R1), assessed for committing a complete record of cluster traffic, so declared inference can be checked.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: required. Attack testing: analysis. Category: Off-chip devices & sensors.
- What the verifier sees: model weights depends; inputs and outputs depends; training data depends. Only hashes leave the site; records picked for a challenge are opened for replay at a verification facility.


## Properties

**Operational use**

- TEE remote attestation for AI workloads: Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware

**Built for an adversarial prover**

- Network taps and certifiers

**No new hardware needed**

- Safeguard attestation
- TEE remote attestation for AI workloads

**Failures since mitigated**

- Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked) (in TEE remote attestation for AI workloads) [11][12][25][26]
- Verifier dictionary attacks on hashes (in Network taps and certifiers) [33]


## Attack testing

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

**Testing history**

- Safeguard attestation: Analysis
- TEE remote attestation for AI workloads: Independent red-team
- Network taps and certifiers: Analysis


## Limits

**Open critical failures**

- DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop) (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/1/) [4][7][8][9][10][11][17][25]. Mechanism-class evidence. Critical when the verifier must resist physical access plus host control on the affected DDR5 platforms. The Intel demonstrations defeat attestation; TEE.fail's AMD demonstration extracts a guest key, not an AMD attestation key. These results do not cover every TEE architecture. Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges.
  - On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations.
  - On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software.

  A second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery.

  The TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026. PAL*M lists this attack class as out of its scope, and Tinfoil's documentation acknowledges it. Gloria Z calls key extraction through bus interposition "relatively low-hanging fruit" in an international treaty scenario.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, not in the proposal). A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
- DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap) (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/2/) [10][22]. Mechanism-class evidence. Critical for the tested DDR4 SGX and SEV-SNP configurations against a physical host attacker. The authors exclude DDR5 from these demonstrations, including TDX servers; the DDR5 attacks have a separate finding. Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host.
  - Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation.
  - WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments.

  Both attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, not in the proposal). A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.

**Open significant failures**

- Components outside the attested boundary (known failure, theoretical argument, in Safeguard attestation; https://trustbutveri.fyi/mechanisms/safeguard-attestation/evidence/flaws/4/) [1][2]. In the proof-of-guardrail experiments, the guardrail model and the agent's backend model were both reached through external APIs, and the authors leave the decision to trust those APIs to the verifier. The measured wrapper must also have no vulnerability that lets the unmeasured agent bypass the guardrail, for example by executing arbitrary commands inside the enclave. The code's README states that the enclave does not currently restrict the agent's arbitrary command execution, which could be used to bypass guardrails.
- Memory-bus interposition extracts attestation keys and forges attestations (known failure, demonstrated attack, in Safeguard attestation; https://trustbutveri.fyi/mechanisms/safeguard-attestation/evidence/flaws/5/) [1][4][7][8][9][10][11][12][13]. Inherited finding. Applies to variants using the affected Intel or AMD trust roots. PAL*M excludes physical attacks. A TDX-backed safeguard claim against a physical host attacker would be defeated, but these studies do not demonstrate a break of the AWS Nitro proof-of-guardrail prototype or of verifier-side recomputation. The TEE findings cover DDR5 attacks on Intel TDX, the H100 relay demonstration, DDR4 attacks on AMD SEV-SNP, and software-only SEV-SNP forgery before AMD's fixes. These are inherited hardware limits; a governance analysis explains why physical access matters in a treaty setting. Related finding: https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/1/.

  Response: Intel and AMD place the physical attack class outside their threat models, according to the researchers. AMD reports firmware fixes for RMPocalypse.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, not in the proposal). A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
- H100 attestation not bound to a specific confidential VM (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/4/) [7]. Mechanism-class evidence. The demonstration combines a genuine H100 report with forged Intel TDX evidence. It depends on the CPU attestation already being defeated; a GPU report alone does not demonstrate that an intact CPU-to-GPU trust chain was bypassed. The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side.
- Side channels and other attacks by the host on CPU and GPU TEEs (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/5/) [4][9][14][27][28]. Mechanism-class evidence. The cited studies concern particular CPU and GPU platforms and attack prerequisites. StackWarp has AMD microcode patches; the open class-level entry does not mean every cited defect is unmitigated or applies to every TEE-backed implementation. PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope. Attestable Audits proposes revoking vulnerable enclave images. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA.
- Root of trust concentrated in a few hardware vendors (known failure, theoretical argument, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/8/) [9][14][31][32]. Mechanism-class evidence. Vendor trust is an assumption of the attestation chain. The root-seed extraction study concerns AMD EPYC Milan and firmware downgrade with privileged host and platform-flash access; it is not evidence of the same failure on Intel, NVIDIA or all AMD generations. The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip. Attestable Audits notes that the approach holds only "as long as the vendor of the secure hardware is trusted". A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021.
- Output nondeterminism leaves covert capacity (known failure, theoretical argument, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/1/) [33][40]. Hashing cannot remove information hidden in the outputs themselves. The Secure Gateway Device paper estimates that about 0.1 bit per token remains even with seed-synchronized replay checks. For a 200k-GPU inference cluster at full load (2,000 tokens per GPU per second), that is about 40 Mbit/s of covert egress, enough to move a 1 TB model in under three days. The paper names this the core remaining challenge and points to deterministic replay or active scrubbing of hardware-induced entropy. An independent study found that an adversary who chooses the prompts roughly doubles the bits leaked per token under Gumbel-based inference verification; see Bounding unexplained information in outputs.

  Related mechanism: Deterministic and bit-exact inference (R3, not in the proposal). Deterministic replay is one of the two remedies the flaw's source names.

  Related mechanism: Bounding unexplained information in outputs (R2, not in the proposal). Bounds the hidden information outputs can carry by measuring what the declared computation fails to predict.
- Residual side channels in simple passive setups (known failure, theoretical argument, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/4/) [36]. Amodo's analysis of its own tapped prototype lists unvalidated header fields, timing of permitted traffic and variation in response formatting as residual channels, and concludes that the passive tap must be replaced by an active one.

**Scope limitations**

- Attestation shows a safeguard ran, not that it is effective (scope limitation, theoretical argument, in Safeguard attestation; https://trustbutveri.fyi/mechanisms/safeguard-attestation/evidence/flaws/1/) [1]. Proof of guardrail ensures that the guardrail executed, but the guardrail can still err or be jailbroken. Because the guardrail must be open source, a malicious developer can attack it with jailbreaks while still presenting a valid proof. In the authors' evaluation, Llama Guard 3 reached an F1 score of 0.56 on the unsafe class of the ToxicChat dataset. The authors state that proof of guardrail should not be interpreted or advertised as proof of safety.
- Selective attestation leaves traffic uncovered (scope limitation, theoretical argument, in Safeguard attestation; https://trustbutveri.fyi/mechanisms/safeguard-attestation/evidence/flaws/2/) [1][4][9]. Attestations are issued per response. In the prototype, the agent offers them when it receives high-stakes questions, so nothing shows that unattested traffic went through the same path. PAL*M's authors note that a prover could cherry-pick favourable executions, and suggest verifier-published nonces or requesting only session-level proofs. A governance analysis notes that auditors also need assurance that all activity is accounted for, since a host could start a second confidential virtual machine that bypasses monitoring.

  Related mechanism: On-chip telemetry from timing, memory and performance counters (R2, not in the proposal). On-chip counters are a proposed route to evidence about everything a chip runs, including a second virtual machine that skips the safeguard.
- Measurements may omit behaviour-relevant configuration or runtime changes (scope limitation, theoretical argument, in Safeguard attestation; https://trustbutveri.fyi/mechanisms/safeguard-attestation/evidence/flaws/3/) [9]. Every component that influences inference behaviour must be covered by the launch measurement, including feature flags, environment variables and invocation arguments. A launch measurement also does not show that a program keeps running as measured if the kernel is later compromised.
- Attestation covers launch state, and measurements can be incomplete (scope limitation, theoretical argument, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/6/) [9][23][24][29][30]. Mechanism-class evidence. A general measurement-boundary limitation. The concrete WhatsApp configuration findings were fixed before launch; Apple's research-environment configuration flaw was also fixed. Their fixes do not remove the need to bind each deployment's runtime inputs. Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself". Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged.
- Deployment-level attestation does not cover the whole chip (scope limitation, theoretical argument, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/7/) [9]. Mechanism-class evidence. A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request. An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan". This matters most for negative claims such as the absence of training.

  Related mechanism: On-chip telemetry from timing, memory and performance counters (R2, not in the proposal). On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give.
- Some links cannot be passively tapped (scope limitation, open question, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/2/) [34][41]. Cankaya notes that copper-connected scale-up domains (for example NVL72 racks and TPU v7 cubes) are much harder to tap than fibre, and that optical budgets make passive taps impractical on 400GBASE-SR8 multimode links. Amodo found no taps advertised for 53 GBaud links as of May 2026.
- Encrypted fabrics hide plaintext from both parties (scope limitation, open question, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/3/) [34]. Cankaya notes that with TEE-protected sessions whose keys are ephemeral and managed inside the TEE, neither the operator nor the manufacturer can recover session keys after the session, so tapped traffic could not be opened for recomputation. For other encrypted fabrics, the operator can retain keys.
- Completeness rests on physical monitoring left out of scope (scope limitation, open question, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/5/) [33]. The Secure Gateway Device paper assumes the facility is physically monitored, and states that the whole architecture depends on the device being the only communication channel. It names radio emanation, power-line signalling and thermal channels as covert channels beyond that scope.

  Related mechanism: Side-channel suppression for isolated facilities (R1, not in the proposal). Addresses the radio, power-line and thermal channels that network-level designs leave out.

**Not yet demonstrated**

- Network taps and certifiers: Proposed (legacy code R1), assessed for committing a complete record of cluster traffic, so declared inference can be checked


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open failure or a dependency. Pointers, not recommendations: each brings its own readiness level and findings, and none is claimed to close a failure.

- **Deterministic and bit-exact inference** (Operational use (legacy code R3), assessed for reproducing open-model inference from receipts in Gensyn's information-market service)
  - Bears on the open significant failure "Output nondeterminism leaves covert capacity" in Network taps and certifiers. Deterministic replay is one of the two remedies the flaw's source names.
  - Network taps and certifiers waits on it: Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove.
- **Bounding unexplained information in outputs** (Research demonstration (legacy code R2), assessed for bounding how much hidden information can leave in checked inference outputs)
  - Bears on the open significant failure "Output nondeterminism leaves covert capacity" in Network taps and certifiers. Bounds the hidden information outputs can carry by measuring what the declared computation fails to predict.
- **Hardware-attested weight binding** (Operational use (legacy code R3), assessed for hardware-attested weight binding showing users that a service runs its committed weights)
  - Safeguard attestation waits on it: Safeguard evidence must be bound to the model actually served, which depends on model-identity attestation.
- **On-chip telemetry from timing, memory and performance counters** (Research demonstration (legacy code R2), assessed for workload evidence from GPU counters and timing, assuming authentic measurements)
  - TEE remote attestation for AI workloads waits on it: Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide.
- **Tamper evidence for verifier devices** (Research demonstration (legacy code R2), assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence)
  - Network taps and certifiers waits on it: Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them.
- **Side-channel suppression for isolated facilities** (Proposed (legacy code R1), assessed for bounding physical covert channels out of a verified enclosure)
  - Network taps and certifiers waits on it: Radio, power-line and thermal channels are not addressed by network-level designs.
- **Sampled inference recomputation** (Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision)
  - Network taps and certifiers depends on it.
- **Hardware-enabled guarantees (flexHEG) and guarantee processors** (Proposed (legacy code R1), assessed for checking and enforcing training-compute limits on chips, against adversaries up to states). Excluded by the filters: needs new chips
  - Bears on the open critical failure "DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop)" in TEE remote attestation for AI workloads. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
  - Bears on the open critical failure "DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)" in TEE remote attestation for AI workloads. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
  - Bears on the open significant failure "Memory-bus interposition extracts attestation keys and forges attestations" in Safeguard attestation. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
  - TEE remote attestation for AI workloads waits on it: Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware.


## Dependencies

**Missing prerequisites**

- Hardware-attested weight binding (Operational use (legacy code R3), assessed for hardware-attested weight binding showing users that a service runs its committed weights), needed by Safeguard attestation
- Sampled inference recomputation (Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision), needed by Network taps and certifiers
- Deterministic and bit-exact inference (Operational use (legacy code R3), assessed for reproducing open-model inference from receipts in Gensyn's information-market service), needed by Network taps and certifiers
- Tamper evidence for verifier devices (Research demonstration (legacy code R2), assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence), needed by Network taps and certifiers
- Side-channel suppression for isolated facilities (Proposed (legacy code R1), assessed for bounding physical covert channels out of a verified enclosure), needed by Network taps and certifiers

**Blockers**

- Safeguard attestation: No published design shows that all of a provider's traffic passes through the attested safeguard path; current evidence covers individual attested responses. (coverage & hidden compute) [1][9]
- Safeguard attestation: Frontier model inference typically needs several GPUs, GPU confidential computing is less mature than CPU support, and CPU inference, which an enclave prototype had to use, ran about 100 times slower than GPU inference. (performance & compatibility; waits on TEE remote attestation for AI workloads) [9][14]
- Safeguard attestation: Trust rests on a small number of hardware vendors, and a per-CPU Intel attestation key has been extracted by physical attack. (hardware trust; waits on TEE remote attestation for AI workloads) [7][9]
- Safeguard attestation: Safeguard evidence must be bound to the model actually served, which depends on model-identity attestation. (evidence binding; waits on Hardware-attested weight binding) [14][29]
- Safeguard attestation: No independent red-team or audit of a safeguard-attestation system has been published, and the available prototypes are described by their authors as proofs of concept that have not been stress-tested by a counterparty. (adversarial validation) [2][6]
- TEE remote attestation for AI workloads: Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware. (hardware trust; waits on Hardware-enabled guarantees (flexHEG) and guarantee processors) [7][8][10][15][22][42]
- TEE remote attestation for AI workloads: Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide. (coverage & hidden compute; waits on On-chip telemetry from timing, memory and performance counters) [9]
- TEE remote attestation for AI workloads: Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's April 2026 release notes list no multi-node confidential mode. (performance & compatibility) [15][43]
- TEE remote attestation for AI workloads: Rival parties have not agreed on trust roots and key provenance they would accept. (access & governance) [9]
- TEE remote attestation for AI workloads: CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost. (performance & compatibility) [14]
- Network taps and certifiers: No complete verification tap has been demonstrated at production frontend link rates, and on the tested CPU no hash algorithm reached line rate with minimum-size frames. (performance & compatibility) [41][44]
- Network taps and certifiers: Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove. (evidence binding; waits on Deterministic and bit-exact inference) [33]
- Network taps and certifiers: Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them. (hardware trust; waits on Tamper evidence for verifier devices) [13][33]
- Network taps and certifiers: Radio, power-line and thermal channels are not addressed by network-level designs. (coverage & hidden compute; waits on Side-channel suppression for isolated facilities) [33]
- Network taps and certifiers: Red-teaming by specialists is called for but has not been reported. (adversarial validation) [33]


## What the verifier sees

- Model weights: shown by none; depends on the design for Safeguard attestation and Network taps and certifiers; hidden by TEE remote attestation for AI workloads; not involved in none; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for Safeguard attestation and Network taps and certifiers; hidden by TEE remote attestation for AI workloads; not involved in none; unspecified for none.
- Training data: shown by none; depends on the design for Network taps and certifiers; hidden by TEE remote attestation for AI workloads; not involved in Safeguard attestation; unspecified for none.

## Implementations

- Safeguard attestation: none on the map
- TEE remote attestation for AI workloads: [Apple Private Cloud Compute](https://trustbutveri.fyi/implementations/apple-private-cloud-compute/) (R3, product); [Attestable Audits](https://trustbutveri.fyi/implementations/attestable-audits/) (R2, research prototype); [Cove](https://trustbutveri.fyi/implementations/cove/) (R2, open-source project); [PAL*M](https://trustbutveri.fyi/implementations/palm/) (R2, research prototype); [Tinfoil model identity (Modelwrap)](https://trustbutveri.fyi/implementations/tinfoil-model-identity/) (R3, product)
- Network taps and certifiers: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture); [SASH confidential network logger](https://trustbutveri.fyi/implementations/sash-confidential-network-logger/) (R1, research prototype)

## Sources

1. Proof-of-Guardrail in AI Agents and What (Not) to Trust from It, X. Jin et al. (2026). https://arxiv.org/abs/2603.05786
2. Verifiable-ClawGuard: proof-of-guardrail reference code, SaharaLabsAI (2026). https://github.com/SaharaLabsAI/Verifiable-ClawGuard
3. Safety Without Compromising on Privacy, D. McCann-Sayles et al. (2026). https://tinfoil.sh/blog/2026-09-14-safety-without-compromising-privacy
4. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). https://arxiv.org/abs/2601.16199
5. Enabling Verifiably-Scoped Monitoring through Large Language Models and Trusted Compute, B. Penchas et al. (2026). https://icml.cc/virtual/2026/78630
6. Auditor-in-a-Box: Tools for Third-Party Auditing, R. Rinberg & B. Penchas (2026). https://www.lesswrong.com/posts/uWYk7MM9hAf9GEbGe/auditor-in-a-box-tools-for-third-party-auditing
7. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). https://tee.fail/
8. DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes, J. De Meulemeester et al. (2026). https://ddropattack.eu/
9. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). https://techgov.intelligence.org/blog/on-tees-for-privacy-preserving-monitoring-in-ai-governance
10. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). https://batteringram.eu/
11. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). https://rmpocalypse.github.io/
12. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3020.html
13. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
14. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). https://arxiv.org/abs/2506.23706
15. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). https://docs.nvidia.com/nvidia-secure-ai-with-blackwell-and-hopper-gpus-whitepaper.pdf
16. Now in General Availability: NVIDIA H100 GPUs in Microsoft Azure Confidential Virtual Machines, C. Su (2024). https://blogs.nvidia.com/blog/azure-confidential-vm-h100-general-availability
17. A primer on secure enclaves, Tinfoil (2026). https://docs.tinfoil.sh/verification/secure-enclave-primer
18. Backend infrastructure, Tinfoil (2026). https://docs.tinfoil.sh/verification/attestation-architecture
19. How verification works in Tinfoil, Tinfoil (2026). https://docs.tinfoil.sh/verification/verification-in-tinfoil
20. modelwrap: Reproducible dm-verity read-only image of Huggingface models, Tinfoil (2026). https://github.com/tinfoilsh/modelwrap
21. Private Cloud Compute: A new frontier for AI privacy in the cloud, Apple Security Engineering and Architecture (SEAR) (2024). https://security.apple.com/blog/private-cloud-compute/
22. WireTap: Breaking Server SGX via DRAM Bus Interposition, A. Seto et al. (2025). https://wiretap.fail/
23. What we learned about TEE security from auditing WhatsApp's Private Inference, Trail of Bits (2026). https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/
24. Meta WhatsApp Private Processing (security review), Trail of Bits (2025). https://trailofbits.com/library/meta-whatsapp-private-processing/
25. Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP, B. Schlüter et al. (2026). https://www.usenix.org/conference/usenixsecurity26/presentation/schlueter-1
26. SEV-SNP Routing Misconfiguration (AMD-SB-3034), AMD (2026). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3034.html
27. Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing, Z. Gu et al. (2026). https://arxiv.org/abs/2507.02770
28. StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine, R. Zhang et al. (2026). https://www.usenix.org/conference/usenixsecurity26/presentation/zhang-ruiyi
29. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). https://tinfoil.sh/blog/2026-02-03-proving-model-identity
30. Beyond Prompt Injection: Hacking Apple's Private Cloud Compute, D. Selmanaj (2026). https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/
31. Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack, M. Shen & Y. Qin (2026). https://arxiv.org/abs/2605.12990
32. MilanLaunchy Firmware Loader (AMD-SB-3045), AMD (2026). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3045.html
33. Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors, N. Cankaya et al. (2026). https://arxiv.org/abs/2606.10724
34. The Fundamentals and Feasibility of Secure Network Taps for Verifying AI Datacenter Use, N. Cankaya (2026). https://nacicankaya.substack.com/p/research-note-the-fundamentals-and
35. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
36. Fitting a Network TAP to our Inference Verification Prototype, Amodo Design (2026). https://amododesign.com/notes/2026-09-15-network-tap-inference-verification/
37. Amodo-Design/Inference-Recomputation-Prototype (GitHub repository), Amodo Design (2026). https://github.com/Amodo-Design/Inference-Recomputation-Prototype
38. inference-verification: Inference Verification Prototype, Singapore AI Safety Hub (SASH) (2026). https://github.com/sg-ai-safety-hub/inference-verification
39. Internationalising AI Verification, Singapore AI Safety Hub (SASH) (2026). https://www.aisafety.sg/research/internationalising-ai-verification
40. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). https://arxiv.org/abs/2608.23375
41. Network Tapping for AI Verification: A Technical Assessment, Amodo Design (2026). https://amododesign.com/notes/2026-05-03-network-tapping/
42. Technical Options for Flexible Hardware-Enabled Guarantees, J. Petrie & O. Aarne (2025). https://arxiv.org/abs/2506.03409
43. NVIDIA Trusted Computing Solutions Release Notes (R595 TRD1), NVIDIA (2026). https://docs.nvidia.com/595trd1-trusted-computing-solutions-release-notes.pdf
44. Network Traffic Hashing, Amodo Design (2026). https://amododesign.com/notes/2026-07-03-network-traffic-hashing/