# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-08. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0015&cols=claims,prover,tested,sees

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's readiness and open flaws. Readiness levels R0 to R4 describe one record's public evidence for its assessed use and are never combined. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and flaws) and https://trustbutveri.fyi/about/readiness/ (readiness levels).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

None set. Every mechanism on the map was available.

## Overview

One row per mechanism, read from its record. Open flaws: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees.

| Mechanism | Readiness | Prover | Attack testing | Hardware | Open flaws | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Memory wiping and proofs of secure erasure | R1 | Adversarial | Analysis | None | 0 / 2 / 1 | not involved | not involved | not involved |

## Claims

No claims chosen.

## Mechanisms

### Memory wiping and proofs of secure erasure

Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches. ([Memory wiping and proofs of secure erasure](https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/))

- Assessment: mechanism family.
- Readiness: R1 Proposed, assessed for showing that no data from earlier work persists in memory the wipe reaches.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: none. Prover cooperation: required. Attack testing: analysis. Category: Isolation & system architectures.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Overwrites memory with verifier-chosen data; it does not handle model data.


## Properties

**Built for an adversarial prover**

- Memory wiping and proofs of secure erasure

**No new hardware needed**

- Memory wiping and proofs of secure erasure


## Attack testing

Published attempts to break a system, including those that found failures. Testing history does not establish that open flaws are resolved.

**Testing history**

- Memory wiping and proofs of secure erasure: Analysis


## Limits

**Open significant flaws**

- Memory the wipe cannot reach (open question, in Memory wiping and proofs of secure erasure; https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/#flaw-1) [5][6]. Amodo's inventory of a GB200 system lists many memory stores beyond GPU HBM and host DRAM. It notes that SSD controller DRAM sits on a private bus that host commands cannot read or write, and that its optimized algorithm leaves 25 GiB of HBM unattested. It also asks how switch memory could be wiped.
- Outside help during challenges (theoretical argument, in Memory wiping and proofs of secure erasure; https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/#flaw-2) [3][4]. Classic proofs of secure erasure assume the device is isolated during the protocol. Bursuc et al. relax this to a bound on how close a helper can be, enforced by round-trip times. In data centres, remote memory access has round trips of about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview therefore says verification depends on ruling out RDMA by latency or physical disconnection.

  Related mechanism: Timed challenge-response and memory-occupation challenges (R2, not in the proposal). Timed challenges bound how far away a helper can be by how quickly it must answer.

  Related mechanism: Bandwidth limits and compartmentalization (R2, not in the proposal). Removing or capping links between groups of accelerators limits remote memory access during a challenge.

**Open minor flaws**

- Gap between erased and total memory (theoretical argument, in Memory wiping and proofs of secure erasure; https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/#flaw-3) [3]. Bursuc et al. note that memory left between the erased region and the device's full memory could hold data, and that their bounds are tighter only against a restricted adversary.

**Not yet demonstrated**

- Memory wiping and proofs of secure erasure: R1 Proposed, assessed for showing that no data from earlier work persists in memory the wipe reaches


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open flaw or a dependency. Pointers, not recommendations: each brings its own readiness level and flaws, and none is claimed to close a flaw.

- **Bandwidth limits and compartmentalization** (R2 Demonstrated, assessed for monitoring inter-node traffic with operator-run software on four GPUs)
  - Bears on the open significant flaw "Outside help during challenges" in Memory wiping and proofs of secure erasure. Removing or capping links between groups of accelerators limits remote memory access during a challenge.
- **Timed challenge-response and memory-occupation challenges** (R2 Demonstrated, assessed for detecting whether a GPU is doing other work)
  - Bears on the open significant flaw "Outside help during challenges" in Memory wiping and proofs of secure erasure. Timed challenges bound how far away a helper can be by how quickly it must answer.
  - Memory wiping and proofs of secure erasure waits on it: Timed challenges must exclude remote memory and other helpers.


## Dependencies

**Missing prerequisites**

- Timed challenge-response and memory-occupation challenges (R2 Demonstrated, assessed for detecting whether a GPU is doing other work), needed by Memory wiping and proofs of secure erasure

**Blockers**

- Memory wiping and proofs of secure erasure: Wipes take time: tens of minutes for a pod's volatile memory and hours for SSDs, displacing work. (performance & compatibility) [4][5][6]
- Memory wiping and proofs of secure erasure: Timed challenges must exclude remote memory and other helpers. (coverage & hidden compute; waits on Timed challenge-response and memory-occupation challenges) [3][4]
- Memory wiping and proofs of secure erasure: All memory stores in a system must be inventoried and wiped at the same time. (coverage & hidden compute) [5]


## What the verifier sees

- Model weights: shown by none; depends on the design for none; hidden by none; not involved in Memory wiping and proofs of secure erasure; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for none; hidden by none; not involved in Memory wiping and proofs of secure erasure; unspecified for none.
- Training data: shown by none; depends on the design for none; hidden by none; not involved in Memory wiping and proofs of secure erasure; unspecified for none.

## Implementations

- Memory wiping and proofs of secure erasure: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture)

## Sources

1. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
2. Secure Code Update for Embedded Devices via Proofs of Secure Erasure, D. Perito & G. Tsudik (2010). https://link.springer.com/chapter/10.1007/978-3-642-15497-3_39
3. Software-Based Memory Erasure with Relaxed Isolation Requirements, S. Bursuc et al. (2024). https://ieeexplore.ieee.org/document/10664348/
4. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
5. Memory Wipes - Performance Analysis, Amodo Design (2026). https://amododesign.com/notes/2026-07-01-memory-wiping/
6. Improving Disk Wiping Speed for Memory Wipes, Amodo Design (2026). https://amododesign.com/notes/2026-09-14-disk-wiping-speed/
7. Amodo-Design/PoSE-Memory-Wiping (GitHub repository), Amodo Design (2026). https://github.com/Amodo-Design/PoSE-Memory-Wiping
8. Empirical Evaluation of Memory-Erasure Protocols, R. Gil-Pons et al. (2025). https://www.scitepress.org/Papers/2025/135548/135548.pdf