Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Whole-workload recomputation (reproducible packets), Memory wiping and proofs of secure erasure and Timed challenge-response and memory-occupation challenges

No new hardware needed

Memory wiping and proofs of secure erasure and Timed challenge-response and memory-occupation challenges

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Memory wiping and proofs of secure erasure: Analysis
• Timed challenge-response and memory-occupation challenges: Analysis

Open significant flaws

5 flaws in 3 mechanisms

• Spare compute is outside the scheme in Whole-workload recomputation (reproducible packets)

  The plan states that it does not verify that spare compute is not used for unapproved workloads, because this seems very challenging. Recomputation checks the correctness of declared work, not its completeness. ^{1 2}

  Theoretical argument · Significant · Open. On the record

  Related mechanism R1 Proofs of useful work for capacity accounting: Proposed as one input to accounting for spare capacity on declared hardware. A pointer, not evidence that this flaw is mitigated. Add

• Non-compliant work could be encoded inside compliant-looking packets in Whole-workload recomputation (reproducible packets)

  The plan notes that an AI company might try to encode a non-compliant workload inside a workload that looks compliant on the surface. ¹

  Theoretical argument · Significant · Open. On the record

• Memory the wipe cannot reach in Memory wiping and proofs of secure erasure

  Amodo's inventory of a GB200 system lists many memory stores beyond GPU HBM and host DRAM. It notes that SSD controller DRAM sits on a private bus that host commands cannot read or write, and that its optimized algorithm leaves 25 GiB of HBM unattested. It also asks how switch memory could be wiped. ^{10 11}

  Open question · Significant · Open. On the record

• Outside help during challenges in Memory wiping and proofs of secure erasure

  Classic proofs of secure erasure assume the device is isolated during the protocol. Bursuc et al. relax this to a bound on how close a helper can be, enforced by round-trip times. In data centres, remote memory access has round trips of about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview therefore says verification depends on ruling out RDMA by latency or physical disconnection. ^{8 9}

  Theoretical argument · Significant · Open. On the record

  Related mechanism R2 Timed challenge-response and memory-occupation challenges: Timed challenges bound how far away a helper can be by how quickly it must answer. A pointer, not evidence that this flaw is mitigated. In the proposal.

  Related mechanism R2 Bandwidth limits and compartmentalization: Removing or capping links between groups of accelerators limits remote memory access during a challenge. A pointer, not evidence that this flaw is mitigated. Add

• Remote memory narrows the timing margin in Timed challenge-response and memory-occupation challenges

  Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges. ⁹

  Theoretical argument · Significant · Open. On the record

  Related mechanism R2 Bandwidth limits and compartmentalization: Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced. A pointer, not evidence that this flaw is mitigated. Add

Open minor flaws

2 mechanisms with minor findings

• Gap between erased and total memory in Memory wiping and proofs of secure erasure

  Bursuc et al. note that memory left between the erased region and the device's full memory could hold data, and that their bounds are tighter only against a restricted adversary. ⁸

  Theoretical argument · Minor · Open. On the record

• Error rates not quantified in Timed challenge-response and memory-occupation challenges

  Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified. ¹⁴

  Open question · Minor · Open. On the record

Not yet demonstrated

R1 Whole-workload recomputation (reproducible packets) and R1 Memory wiping and proofs of secure erasure

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R2 Bandwidth limits and compartmentalization Add
  • Bears on the open significant flaw “Outside help during challenges” in Memory wiping and proofs of secure erasure. Removing or capping links between groups of accelerators limits remote memory access during a challenge.
  • Bears on the open significant flaw “Remote memory narrows the timing margin” in Timed challenge-response and memory-occupation challenges. Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced.
  • Timed challenge-response and memory-occupation challenges waits on it. Outside help, such as remote memory, must be excluded during challenges.
• R1 Proofs of useful work for capacity accounting Add
  • Bears on the open significant flaw “Spare compute is outside the scheme” in Whole-workload recomputation (reproducible packets). Proposed as one input to accounting for spare capacity on declared hardware.
• R3 Deterministic and bit-exact inference Add
  • Whole-workload recomputation (reproducible packets) waits on it. Workloads are not reproducible by default, and achieving reproducibility may cost performance.
• R1 Network taps and certifiers Add
  • Whole-workload recomputation (reproducible packets) waits on it. All traffic must reach the recomputation server via network taps, and the server's integrity is critical.

Missing prerequisites

• R3 Deterministic and bit-exact inference needed by Whole-workload recomputation (reproducible packets) Add
• R1 Network taps and certifiers needed by Whole-workload recomputation (reproducible packets) Add

Blockers

10 blockers recorded

• Whole-workload recomputation (reproducible packets)
  • Workloads are not reproducible by default, and achieving reproducibility may cost performance. Performance & compatibility. Waits on Deterministic and bit-exact inference ¹
  • Network packets are not individually reproducible by default; making them so may need considerable software, firmware and hardware work. Amodo rates this 'not on track'. Performance & compatibility ⁴
  • All traffic must reach the recomputation server via network taps, and the server's integrity is critical. Hardware trust. Waits on Network taps and certifiers ^{1 4}
  • Recomputing training steps needs checkpoints: writing one at every step would cost more than 100% overhead, so Amodo's design needs a spare data-parallel replica that tracks the weights instead. Performance & compatibility ²
• Memory wiping and proofs of secure erasure
  • Wipes take time: tens of minutes for a pod's volatile memory and hours for SSDs, displacing work. Performance & compatibility ^{9 10 11}
  • Timed challenges must exclude remote memory and other helpers. Coverage & hidden compute. Waits on Timed challenge-response and memory-occupation challenges ^{8 9}
  • All memory stores in a system must be inventoried and wiped at the same time. Coverage & hidden compute ¹⁰
• Timed challenge-response and memory-occupation challenges
  • No network-level memory challenge across data-centre servers has been demonstrated. Adversarial validation ⁹
  • Challenges that fill memory displace workloads; filling a pod's volatile memory takes tens of minutes and SSDs take hours. Performance & compatibility ^{9 14}
  • Outside help, such as remote memory, must be excluded during challenges. Coverage & hidden compute. Waits on Bandwidth limits and compartmentalization ⁹

From the family or selected implementation's record. ?

Model weights

Depends on the design for Whole-workload recomputation (reproducible packets).

Not involved: Memory wiping and proofs of secure erasure and Timed challenge-response and memory-occupation challenges.

Inputs and outputs

Depends on the design for Whole-workload recomputation (reproducible packets).

Not involved: Memory wiping and proofs of secure erasure and Timed challenge-response and memory-occupation challenges.

Training data

Depends on the design for Whole-workload recomputation (reproducible packets).

Not involved: Memory wiping and proofs of secure erasure and Timed challenge-response and memory-occupation challenges.

Whole-workload recomputation (reproducible packets)

• R1 AI 2040 inference-only verification stack Proposed architecture, AI Futures Project

Memory wiping and proofs of secure erasure

• R1 AI 2040 inference-only verification stack Proposed architecture, AI Futures Project
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute

Timed challenge-response and memory-occupation challenges

• R1 Data-centre memory challenging Proposed architecture, Machine Intelligence Research Institute
• R2 GPU contention probes Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 SAGE Research prototype
• R2 VRAM-residency challenge Research prototype

1. Verification Plan, R. Dean (2026). Original
2. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). Original
3. Scaling Recomputation Inference Verification, Amodo Design (2026). Original
4. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original
5. Get Involved in Verification, AI Futures Project (2026). Original
6. Proof-of-Learning is Currently More Broken Than You Think, C. Fang et al. (2023). Original
7. Secure Code Update for Embedded Devices via Proofs of Secure Erasure, D. Perito & G. Tsudik (2010). Original
8. Software-Based Memory Erasure with Relaxed Isolation Requirements, S. Bursuc et al. (2024). Original
9. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
10. Memory Wipes - Performance Analysis, Amodo Design (2026). Original
11. Improving Disk Wiping Speed for Memory Wipes, Amodo Design (2026). Original
12. Amodo-Design/PoSE-Memory-Wiping (GitHub repository), Amodo Design (2026). Original
13. Empirical Evaluation of Memory-Erasure Protocols, R. Gil-Pons et al. (2025). Original
14. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). Original
15. SAGE: Software-based Attestation for GPU Execution, A. Ivanov et al. (2023). Original
16. SWATT: SoftWare-based ATTestation for Embedded Devices, A. Seshadri et al. (2004). Original
17. Proofs of Space, S. Dziembowski et al. (2015). Original
18. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). Original
19. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). Original