Proposal Explorer

For the goal Prevent catastrophic misuse. Each of its claims is marked direct or supporting.

1. Communication between compute groups is bounded Supporting

Unaddressed

No mechanism in the proposal addresses it.

2. The declared model is the one being served Supporting

Addressed

Aimed at it: Confidential multi-party verification

Goal claims not in the proposal

• Declared safeguards were applied during inference Direct Add
• Model weights have not left the facility Direct Add

Outside this map

• Capability evaluations. Baker and colleagues describe mitigations as proportionate to evaluated risks. They leave improving model evaluations as a separate unsolved problem. M. Baker et al. 2025
• User identity. Cankaya's example rule separates whitelisted users from others. This map has no records for checking who a user is. N. Cankaya 2026

No new hardware needed

Confidential multi-party verification

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

• Confidential multi-party verification: Analysis

Claims not fully addressed

• Communication between compute groups is bounded No mechanism in the proposal addresses it.

Open significant failures

2 failures in 1 mechanism

• Released verdicts can leak information about private inputs in Confidential multi-party verification

  Even a one-bit result can reveal more than intended. Abdelghafar and Kulp used the published evaluation of Auditor-in-a-Box, whose output filter is meant to disclose at most one bit. Given only the valid or invalid decision on a new request, a simple predictor identified which of two request sets it came from (borderline or proxy requests versus ordinary research requests) with 72.4% balanced accuracy, against 50% without the decision. In a second experiment, which distinguished reinforcement-learning workloads from others, several candidate one-bit reports revealed exact-workload information. ⁹

  Known failure · Demonstrated attack · Significant · Open. On the record

• Memory-bus interposition extracts attestation keys and forges attestations in Confidential multi-party verification

  Applies to enclave workflows using affected Intel or AMD platforms, including Cove's TDX reference and the PySyft pilot's TDX and H100 stack. A physical host attacker who defeats the accepted trust root defeats that variant's confidentiality and veracity. These studies do not test the PySyft workflow or ZkAudit's cryptographic route.

  The platform-specific attacks and fixes are collected in the TEE findings. Intel TDX attestations were forged with physical access to DDR5 systems and combined with H100 relay. AMD SEV-SNP attestation was defeated on DDR4 by Battering RAM and from malicious host software by RMPocalypse before AMD's fixes. ^{1 6 7 10 11 12 13 14}

  Response: The researchers report that Intel and AMD treat physical interposer attacks as out of scope. AMD reports firmware fixes for RMPocalypse.

  Known failure · Demonstrated attack · Significant · Open · Inherited finding. On the record · Related finding in TEE remote attestation for AI workloads

  Related mechanism Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this failure is mitigated. Add

Scope limitations

• Guarantees depend on the host software stack and on review in Confidential multi-party verification

  Cove's developers state that compromise of the Docker daemon, host kernel or TEE stack breaks all guarantees. They also state that Docker policy alone cannot prove that guest code cannot generate a quote if the platform exposes quote instructions globally, and that compiled workflow bundles are hashed and reviewable but not signed by a publisher key. ⁶

  Scope limitation · Theoretical argument. On the record

• Completeness is not established in Confidential multi-party verification

  A confidential workflow proves facts about the records and models submitted to it. A governance analysis notes that an auditor also needs assurance that all activity is accounted for, since a host could start a second confidential virtual machine that uses a different model or bypasses monitoring. ¹⁵

  Scope limitation · Theoretical argument. On the record

  Related mechanism Research demo On-chip telemetry from timing, memory and performance counters: On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give. A pointer, not evidence that this failure is mitigated. Add

• Zero-knowledge audits reveal model architecture in Confidential multi-party verification

  ZkAudit keeps weights and data secret but reveals the model architecture, and it does not protect against data poisoning. ⁷

  Scope limitation · Theoretical argument. On the record

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• Research demo Bandwidth limits and compartmentalization Add
  • Aimed at claim 1, Communication between compute groups is bounded, which is unaddressed.
• Proposed Side-channel suppression for isolated facilities Add
  • Aimed at claim 1, Communication between compute groups is bounded, which is unaddressed.
• Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors Add
  • Bears on the open significant failure “Memory-bus interposition extracts attestation keys and forges attestations” in Confidential multi-party verification. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
• Operational use TEE remote attestation for AI workloads Add
  • Confidential multi-party verification waits on it. Frontier inference typically needs the resources of several GPUs, and published confidential evaluations ran on a single server, so the double-blind pilot's authors name many-node confidential H100 or B200 clusters as the next milestone.
  • Confidential multi-party verification waits on it. Trust rests on a small number of hardware vendors, and a per-CPU Intel attestation key has been extracted by physical attack.
• Research demo Zero-knowledge proofs of inference Add
  • Confidential multi-party verification waits on it. Zero-knowledge audits have been shown on image classifiers and a recommender model, not language models at frontier scale, and a counterfactual audit of the recommender cost $8,456.

Missing prerequisites

• Operational use TEE remote attestation for AI workloads needed by Confidential multi-party verification Add

Blockers

5 blockers recorded

• Confidential multi-party verification
  • Frontier inference typically needs the resources of several GPUs, and published confidential evaluations ran on a single server, so the double-blind pilot's authors name many-node confidential H100 or B200 clusters as the next milestone. Performance & compatibility. Waits on TEE remote attestation for AI workloads ^{1 4 15}
  • Zero-knowledge audits have been shown on image classifiers and a recommender model, not language models at frontier scale, and a counterfactual audit of the recommender cost $8,456. Performance & compatibility. Waits on Zero-knowledge proofs of inference ⁷
  • Trust rests on a small number of hardware vendors, and a per-CPU Intel attestation key has been extracted by physical attack. Hardware trust. Waits on TEE remote attestation for AI workloads ^{10 15}
  • Parties must negotiate the plan or workflow and handle false positives and appeals, which the Auditor-in-a-Box authors list as open problems. Access & governance ¹⁶
  • Released evidence must be designed to limit collateral leakage, which requires declaring protected properties in advance and calibrating on labelled executions. Privacy & leakage ⁹

From the family or selected implementation's record. ?

Model weights

Hidden by Confidential multi-party verification.

Inputs and outputs

Hidden by Confidential multi-party verification.

Training data

Hidden by Confidential multi-party verification.

Confidential multi-party verification

• Research demo Attestable Audits Research prototype, University of Cambridge
• Research demo Cove Open-source project
• Research demo PySyft double-blind evaluations Research prototype, OpenMined

1. Double Blind Evals: Resolving the Dual Confidentiality Dilemma in AI Safety Auditing, A. Trask et al. (2026). Original
2. Confidential Space overview, Google Cloud (2026). Original
3. Confidential Space release notes, Google Cloud (2026). Original
4. Confidential computing can enable better frontier AI auditing, A. Tlaie Boria (2026). Original
5. Cove: Compositional Multi-Party Confidential Workflows for Verifiable AI Governance, S. Ding et al. (2026). Original
6. Cove: Compositional Multi-Party Confidential Workflows for Verifiable AI Governance (reference implementation), covehub (2026). Original
7. Trustless Audits without Revealing Data or Models, S. Waiwitlikhit et al. (2024). Original
8. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). Original
9. Privacy-Preserving AI Verification via Minimal Information Disclosure, S. Abdelghafar & G. Kulp (2026). Original
10. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). Original
11. DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes, J. De Meulemeester et al. (2026). Original
12. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). Original
13. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). Original
14. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). Original
15. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). Original
16. Auditor-in-a-Box: Tools for Third-Party Auditing, R. Rinberg & B. Penchas (2026). Original