# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-08. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0010,M-0020,M-0017&coop=partial

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's readiness and open flaws. Readiness levels R0 to R4 describe one record's public evidence for its assessed use and are never combined. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and flaws) and https://trustbutveri.fyi/about/readiness/ (readiness levels).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

- **Prover cooperation: Partial at most.** "Partial at most" removes mechanisms that need the prover's active participation. "Not required" keeps only those that work without it. Required: the prover takes part, for example by logging requests, producing proofs or opening records. Partial: some access, such as installing a device. Not required: works from outside, such as satellite imagery.

6 of 25 mechanisms on the map pass these filters.

## Overview

One row per mechanism, read from its record. Open flaws: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees.

| Mechanism | Readiness | Prover | Attack testing | Hardware | Open flaws | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| On-chip telemetry from timing, memory and performance counters | R2 | Semi-trusted | Red-teamed | Existing features | 1 / 3 / 1 | depends | depends | depends |
| Remote detection of data centres | R1 | Adversarial | Analysis | None | 0 / 3 / 0 | not involved | not involved | not involved |
| Tamper evidence for verifier devices | R2 | Adversarial | Analysis | Retrofit device | 0 / 3 / 0 | not involved | not involved | not involved |

## Claims

No claims chosen.

## Mechanisms

### On-chip telemetry from timing, memory and performance counters

Uses timing, memory-residency and performance-counter signals measured on AI accelerators as evidence about which workloads they are running. ([On-chip telemetry from timing, memory and performance counters](https://trustbutveri.fyi/mechanisms/on-chip-telemetry/))

- Assessment: mechanism family.
- Readiness: R2 Demonstrated, assessed for workload evidence from GPU counters and timing, assuming authentic measurements.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: partial. Attack testing: red-teamed. Category: On-chip & hardware-enabled.
- What the verifier sees: model weights depends; inputs and outputs depends; training data depends. Counters do not read weights or data, but richer counters can leak secrets through side channels.

### Remote detection of data centres

Remote detection locates large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records such as permits. ([Remote detection of data centres](https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/))

- Assessment: mechanism family.
- Readiness: R1 Proposed, assessed for finding undeclared data centres above an agreed compute threshold.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: none. Prover cooperation: not required. Attack testing: analysis. Category: Remote & side-channel sensing.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Works from outside the facility; it does not handle model data.

### Tamper evidence for verifier devices

Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating. ([Tamper evidence for verifier devices](https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/))

- Assessment: mechanism family.
- Readiness: R2 Demonstrated, assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: partial. Attack testing: analysis. Category: Off-chip devices & sensors.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Protects verifier devices; it does not handle model data.


## Properties

**Built for an adversarial prover**

- Remote detection of data centres
- Tamper evidence for verifier devices

**No new hardware needed**

- On-chip telemetry from timing, memory and performance counters
- Remote detection of data centres


## Attack testing

Published attempts to break a system, including those that found failures. Testing history does not establish that open flaws are resolved.

**Testing history**

- On-chip telemetry from timing, memory and performance counters: Red-teamed
- Remote detection of data centres: Analysis
- Tamper evidence for verifier devices: Analysis


## Limits

**Open critical flaws**

- Software-read telemetry can be forged by the operator (theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/#flaw-1) [1][3]. NVML-based classification assumes trustworthy telemetry. Without a tamper-resistant read path, an authenticated telemetry channel and secure boot of the monitoring software, an operator who controls the full software stack could forge counter values. Monfared et al. start from the same premise: current GPUs expose little trusted telemetry and can be modified or virtualized.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, not in the proposal). A guarantee processor on the chip would give the tamper-resistant, authenticated telemetry path the flaw says is missing.

**Open significant flaws**

- Adversarially disguised fine-tuning partly evades classification (demonstrated attack, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/#flaw-2) [3]. Across 20 evasion strategy families in five monitor-evader rounds, the classifier's accuracy against the most challenging disguised workloads held out from training was 43–87%. White-box LoRA fine-tuning was the only evasion family detected less than half the time. The evaluation covered single nodes, PyTorch-level evasion and NVIDIA hardware.
- Timing challenges do not identify the individual chip (theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/#flaw-3) [1]. GEMM and VDF challenges can be answered by identical GPUs elsewhere, and floating-point fingerprints distinguish GPU models, not individual devices. GPU virtualization adds timing leakage that prevents attributing compute use.
- Counters leak information about protected workloads (theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/#flaw-4) [4][5]. Performance counters have been used as a side channel against TEEs, for example in CounterSEVeillance. NVIDIA disables performance counters in full confidential-computing mode, stating that they could provide an avenue for side-channel attacks. Richer counters for verification therefore pull against confidentiality.
- Facilities can be disguised or hidden (theoretical argument, in Remote detection of data centres; https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/#flaw-1) [6]. Halstead and Larsen discuss two ways to hide a facility. One is to disguise it as a legitimate industrial site. The other is to build it underground, with cooling that avoids visible heat plumes. They note that the underground option requires bespoke engineering.
- Small sites may not be detectable (theoretical argument, in Remote detection of data centres; https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/#flaw-2) [6][8]. Halstead and Larsen conclude that a sufficiently small covert project could not be ruled out with confidence. In their estimates, the chance of detection is lower for smaller sites. Krawec notes that small data centres in existing buildings may lack the distinctive features of large facilities.

  Related mechanism: Chip registries and manufacturing records (R1, not in the proposal). Accounts for chips from the fab onwards, which does not depend on a site being visible.
- Search for unknown sites is undemonstrated (open question, in Remote detection of data centres; https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/#flaw-3) [8]. Krawec reports that telling data centres apart from other industrial facilities systematically is difficult. Automating detection would need large amounts of training imagery and a purpose-trained model. In Krawec's words, automated data-centre detection "remains primarily conceptual at present".
- Seals are often defeated with simple methods (demonstrated attack, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/#flaw-1) [18][19]. Mechanism-class evidence. Published defeats of general security seals. They warn about proposed verifier-device seals, but do not demonstrate defeat of an AI verification enclosure or sensor. In 1996 a Los Alamos vulnerability assessment defeated all 94 security seals it examined, with 132 defeats in total, using rapid, inexpensive, low-tech methods. It found that seal cost did not predict security. In 2001 Johnston reported that high-tech seals are often easier to defeat than low-tech ones.
- Security depends on inspection protocols (theoretical argument, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/#flaw-2) [16][19]. Mechanism-class evidence. An inspection and protocol requirement drawn from safeguards and enclosure studies, not a reported break of a deployed AI verifier. Johnston argues that a seal is no better than the protocols for using it, and that inspectors are usually given little useful information on how to detect tampering. The Sandia survey notes that larger enclosures are hard to inspect fully and that sensor data must be authenticated.
- Attack classes outside published models (open question, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/#flaw-3) [11][12][20]. Mechanism-class evidence. The radio compensation result is emulated using measured channel data under a known-reference attacker model. It is not a physical bypass demonstration against an AI verifier enclosure. The authors of the batteryless cover say they cannot assess chemical-solvent attacks, which exceed their expertise, and deem cover removal impractical. Anti-Tamper Radio's reference can drift as the environment or measurement system ages; the authors suggest gradually renewing the reference. A 2025 follow-up by some of the same authors shows, by emulation on measured channel data, that an attacker who knows the reference channel and the needle's effect on it could inject a signal that cancels the change caused by a needle insertion. It proposes a reconfigurable intelligent surface that randomizes the channel as a countermeasure.

**Open minor flaws**

- No quantified error rates or formal thresholds for timing primitives (open question, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/#flaw-5) [1]. Monfared et al. state that false-positive and false-negative rates are not quantified and leave hardware-specific formal thresholds to future work.

**Not yet demonstrated**

- Remote detection of data centres: R1 Proposed, assessed for finding undeclared data centres above an agreed compute threshold


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open flaw or a dependency. Pointers, not recommendations: each brings its own readiness level and flaws, and none is claimed to close a flaw.

- **Hardware-enabled guarantees (flexHEG) and guarantee processors** (R1 Proposed, assessed for checking and enforcing training-compute limits on chips, against adversaries up to states). Excluded by the filters: prover cooperation required
  - Bears on the open critical flaw "Software-read telemetry can be forged by the operator" in On-chip telemetry from timing, memory and performance counters. A guarantee processor on the chip would give the tamper-resistant, authenticated telemetry path the flaw says is missing.
  - On-chip telemetry from timing, memory and performance counters waits on it: Shipping accelerators need a tamper-resistant, authenticated telemetry path.
- **Chip registries and manufacturing records** (R1 Proposed, assessed for a checkable record of which chips were made and who declared owning them). Excluded by the filters: prover cooperation required
  - Bears on the open significant flaw "Small sites may not be detectable" in Remote detection of data centres. Accounts for chips from the fab onwards, which does not depend on a site being visible.
- **TEE remote attestation for AI workloads** (R3 In production, assessed for showing which software ran to a party that distrusts the operator holding the hardware). Excluded by the filters: prover cooperation required
  - On-chip telemetry from timing, memory and performance counters depends on it.


## Dependencies

**Missing prerequisites**

- TEE remote attestation for AI workloads (R3 In production, assessed for showing which software ran to a party that distrusts the operator holding the hardware), needed by On-chip telemetry from timing, memory and performance counters

**Blockers**

- On-chip telemetry from timing, memory and performance counters: Shipping accelerators need a tamper-resistant, authenticated telemetry path. (hardware trust; waits on Hardware-enabled guarantees (flexHEG) and guarantee processors) [2][3]
- On-chip telemetry from timing, memory and performance counters: NVIDIA's full confidential-computing mode disables the hardware performance counters its profiling tools use, so telemetry that needs them conflicts with it. (privacy & leakage) [4][5]
- On-chip telemetry from timing, memory and performance counters: Continuous challenge puzzles cost power and throughput on production workloads. (performance & compatibility) [1]
- On-chip telemetry from timing, memory and performance counters: Evaluation has not gone beyond single nodes, framework-level evasion and one vendor's hardware. (adversarial validation) [3]
- Remote detection of data centres: Wide-area, automated detection of data centres is not yet practical and needs large training datasets. (coverage & hidden compute) [8]
- Remote detection of data centres: No measured detection or false-alarm rates for finding undeclared facilities have been published. (adversarial validation) [6][8]
- Remote detection of data centres: Recent high-resolution imagery is costly, is limited by weather and needs trained analysts. (access & governance) [8]
- Tamper evidence for verifier devices: No tamper-evident enclosure has been designed for AI verifier hardware at retrofit scale. (hardware trust) [17]
- Tamper evidence for verifier devices: Battery-backed designs add bulk, limit operating temperature (+10 °C to +35 °C for the IBM 4765) and complicate transport. (performance & compatibility) [12]
- Tamper evidence for verifier devices: Active monitoring needs power, and visual inspection of large enclosures faces access limits. (access & governance) [16]
- Tamper evidence for verifier devices: No evaluation has been published in the AI verification setting. (adversarial validation) [17]


## What the verifier sees

- Model weights: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by none; not involved in Remote detection of data centres and Tamper evidence for verifier devices; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by none; not involved in Remote detection of data centres and Tamper evidence for verifier devices; unspecified for none.
- Training data: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by none; not involved in Remote detection of data centres and Tamper evidence for verifier devices; unspecified for none.

## Implementations

- On-chip telemetry from timing, memory and performance counters: none on the map
- Remote detection of data centres: none on the map
- Tamper evidence for verifier devices: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture)

## Sources

1. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). https://arxiv.org/abs/2602.09369
2. Guaranteeable Memory: An HBM-Based Chiplet for Verifiable AI Workloads, J. Petrie (2025). https://openreview.net/forum?id=uc79kOv0MV
3. Detecting Hidden ML Training With Zero-Overhead Telemetry, R. Rahman & S. Tajdari (2026). https://arxiv.org/abs/2606.19262
4. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). https://techgov.intelligence.org/blog/on-tees-for-privacy-preserving-monitoring-in-ai-governance
5. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). https://docs.nvidia.com/nvidia-secure-ai-with-blackwell-and-hopper-gpus-whitepaper.pdf
6. Covert AI Projects, B. Halstead & T. Larsen (2026). https://ai-2040.com/supplements/covert-ai-projects
7. Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment, M. Baker et al. (2025). https://www.rand.org/pubs/working_papers/WRA4077-1.html
8. Tracking Hyperscale AI Data Center Growth with Satellite Imagery, C. Krawec (2026). https://fas.org/publication/tracking-hyperscale/
9. Introducing the Frontier Data Centers Hub, Epoch AI (2025). https://epoch.ai/latest/introducing-the-frontier-data-centers-hub
10. AI Data Centers Documentation – Methodology, Epoch AI (2026). https://epoch.ai/data/data-centers-documentation/methodology
11. Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems, P. Staat et al. (2022). https://ieeexplore.ieee.org/document/9833631/
12. Secure Physical Enclosures from Covers with Tamper-Resistance, V. Immler et al. (2019). https://tches.iacr.org/index.php/TCHES/article/view/7334
13. ImpedanceVerif: On-Chip Impedance Sensing for System-Level Tampering Detection, T. Mosavirik et al. (2023). https://eprint.iacr.org/2022/946
14. IBM 4765 Cryptographic Coprocessor Security Module: Security Policy, IBM Corporation (2012). https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp1505.pdf
15. PHYSEC SEAL: Change detection for maximum safety, PHYSEC GmbH (2026). https://www.physec.de/en/solutions/physec-seal/
16. Tamper-Indicating Enclosures, A Current Survey, H. A. Smartt & Z. N. Gastelum (2015). https://www.osti.gov/servlets/purl/1256541
17. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
18. Physical Security and Tamper-Indicating Devices, R. G. Johnston & A. R. E. Garcia (1996). https://www.osti.gov/servlets/purl/459707
19. Tamper Detection for Safeguards and Treaty Monitoring: Fantasies, Realities, and Potentials, R. G. Johnston (2001). https://www.nonproliferation.org/wp-content/uploads/npr/81john.pdf
20. Anti-Tamper Radio Meets Reconfigurable Intelligent Surface for System-Level Tamper Detection, M. S. Tabar et al. (2025). https://arxiv.org/abs/2503.14279