Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Whole-workload recomputation (reproducible packets) and Timed challenge-response and memory-occupation challenges

No new hardware needed

Timed challenge-response and memory-occupation challenges

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Timed challenge-response and memory-occupation challenges, SAGE: Analysis

Family findings

• Timed challenge-response and memory-occupation challenges

  Context for SAGE. These findings concern the family or other implementations; applicability must be checked against their stated scope.

  • Timing-based software attestation has been broken in practice in Timed challenge-response and memory-occupation challenges

    Castelluccia et al. implemented two generic attacks, one based on a return-oriented rootkit and one on code compression, together with specific attacks on SWATT and ICE-based schemes, on commodity sensor nodes. They conclude that secure time-based attestation is "very difficult, if not impossible, to design correctly". The attacks target embedded schemes, not AI accelerators. ^{8 9}

    Response: Perrig and van Doorn, two of the designers of SWATT and ICE, replied in August 2010. They argue that the rootkit attack defeats a naive implementation, not a property the schemes claim, and that the SWATT attack was run on a re-implementation on a chip with eight times the program memory, where SWATT's own chip is almost always full of code. They accept that the attack on ICE works.

    Demonstrated attack · Significant · Disputed. On the record

  • Remote memory narrows the timing margin in Timed challenge-response and memory-occupation challenges

    Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges. ¹⁰

    Theoretical argument · Significant · Open. On the record

    Related mechanism R2 Bandwidth limits and compartmentalization: Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced. A pointer, not evidence that this flaw is mitigated. Add

  • Error rates not quantified in Timed challenge-response and memory-occupation challenges

    Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified. ¹¹

    Open question · Minor · Open. On the record

Open significant flaws

2 flaws in 1 mechanism

• Spare compute is outside the scheme in Whole-workload recomputation (reproducible packets)

  The plan states that it does not verify that spare compute is not used for unapproved workloads, because this seems very challenging. Recomputation checks the correctness of declared work, not its completeness. ^{1 2}

  Theoretical argument · Significant · Open. On the record

  Related mechanism R1 Proofs of useful work for capacity accounting: Proposed as one input to accounting for spare capacity on declared hardware. A pointer, not evidence that this flaw is mitigated. Add

• Non-compliant work could be encoded inside compliant-looking packets in Whole-workload recomputation (reproducible packets)

  The plan notes that an AI company might try to encode a non-compliant workload inside a workload that looks compliant on the surface. ¹

  Theoretical argument · Significant · Open. On the record

Open minor flaws

1 mechanism with minor findings

• Self-modifying code limits the timing margin in SAGE

  The authors report that their implementation reaches 75% of maximum GPU utilisation when the checksum uses self-modifying code, and that this limits the time difference caused by an adversary who inserts instructions into the checksum loop. They note that other cache-eviction strategies could raise utilisation. ⁷

  Open question · Minor · Open. On the record

Not yet demonstrated

R1 Whole-workload recomputation (reproducible packets)

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R1 Proofs of useful work for capacity accounting Add
  • Bears on the open significant flaw “Spare compute is outside the scheme” in Whole-workload recomputation (reproducible packets). Proposed as one input to accounting for spare capacity on declared hardware.
• R3 Deterministic and bit-exact inference Add
  • Whole-workload recomputation (reproducible packets) waits on it. Workloads are not reproducible by default, and achieving reproducibility may cost performance.
• R1 Network taps and certifiers Add
  • Whole-workload recomputation (reproducible packets) waits on it. All traffic must reach the recomputation server via network taps, and the server's integrity is critical.

Missing prerequisites

• R3 Deterministic and bit-exact inference needed by Whole-workload recomputation (reproducible packets) Add
• R1 Network taps and certifiers needed by Whole-workload recomputation (reproducible packets) Add

Blockers

6 blockers recorded

• Whole-workload recomputation (reproducible packets)
  • Workloads are not reproducible by default, and achieving reproducibility may cost performance. Performance & compatibility. Waits on Deterministic and bit-exact inference ¹
  • Network packets are not individually reproducible by default; making them so may need considerable software, firmware and hardware work. Amodo rates this 'not on track'. Performance & compatibility ⁴
  • All traffic must reach the recomputation server via network taps, and the server's integrity is critical. Hardware trust. Waits on Network taps and certifiers ^{1 4}
  • Recomputing training steps needs checkpoints: writing one at every step would cost more than 100% overhead, so Amodo's design needs a spare data-parallel replica that tracks the weights instead. Performance & compatibility ²
• Timed challenge-response and memory-occupation challenges
  • The verifier must know the exact hardware configuration of the GPU. Hardware trust ⁷
  • The verifier runs in an SGX enclave on the same host as the GPU, so the scheme inherits trust in that enclave. Hardware trust ⁷

From the family or selected implementation's record. ?

Model weights

Depends on the design for Whole-workload recomputation (reproducible packets).

Unspecified for Timed challenge-response and memory-occupation challenges. Check the implementation record.

Inputs and outputs

Depends on the design for Whole-workload recomputation (reproducible packets).

Unspecified for Timed challenge-response and memory-occupation challenges. Check the implementation record.

Training data

Depends on the design for Whole-workload recomputation (reproducible packets).

Unspecified for Timed challenge-response and memory-occupation challenges. Check the implementation record.

Whole-workload recomputation (reproducible packets)

• R1 AI 2040 inference-only verification stack Proposed architecture, AI Futures Project

Timed challenge-response and memory-occupation challenges

• R1 Data-centre memory challenging Proposed architecture, Machine Intelligence Research Institute
• R2 GPU contention probes Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 SAGE Research prototype
• R2 VRAM-residency challenge Research prototype

1. Verification Plan, R. Dean (2026). Original
2. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). Original
3. Scaling Recomputation Inference Verification, Amodo Design (2026). Original
4. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original
5. Get Involved in Verification, AI Futures Project (2026). Original
6. Proof-of-Learning is Currently More Broken Than You Think, C. Fang et al. (2023). Original
7. SAGE: Software-based Attestation for GPU Execution, A. Ivanov et al. (2023). Original
8. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). Original
9. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). Original
10. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
11. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). Original