# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-08. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0014,M-0016&implementations=M-0016:I-0021

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's readiness and open flaws. Readiness levels R0 to R4 describe one record's public evidence for its assessed use and are never combined. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and flaws) and https://trustbutveri.fyi/about/readiness/ (readiness levels).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

None set. Every mechanism on the map was available.

## Overview

One row per mechanism, read from its record. Open flaws: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees.

| Mechanism | Readiness | Prover | Attack testing | Hardware | Open flaws | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Bandwidth limits and compartmentalization | R2 | Adversarial | Analysis | Retrofit device | 0 / 5 / 0 | not involved | not involved | not involved |
| Timed challenge-response and memory-occupation challenges / SAGE | R2 | Adversarial | Analysis | Existing features | 0 / 0 / 1 | unspecified | unspecified | unspecified |

## Claims

No claims chosen.

## Mechanisms

### Bandwidth limits and compartmentalization

Capping or removing network links between groups of accelerators, so that serving within each group still works but large training across groups becomes far slower. ([Bandwidth limits and compartmentalization](https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/))

- Assessment: mechanism family.
- Readiness: R2 Demonstrated, assessed for monitoring inter-node traffic with operator-run software on four GPUs.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: required. Attack testing: analysis. Category: Isolation & system architectures.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Caps traffic between groups of chips; it does not read the traffic's content.

### Timed challenge-response and memory-occupation challenges

A software-only attestation scheme in which a GPU must compute a checksum over its own code within a time limit, without trusted GPU hardware. ([Timed challenge-response and memory-occupation challenges](https://trustbutveri.fyi/mechanisms/timed-challenge-response/))

- Assessment: selected implementation [SAGE](https://trustbutveri.fyi/implementations/sage-gpu-attestation/).
- Readiness: R2 Demonstrated, assessed for attesting code execution on a GPU that lacks hardware trusted-execution support.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: existing features. Prover cooperation: required. Attack testing: analysis. Category: Cryptographic & computational.
- What the verifier sees: model weights unspecified; inputs and outputs unspecified; training data unspecified. This Explorer has no asset-specific exposure assessment for this implementation. Check its source and deployment assumptions.


## Properties

**Built for an adversarial prover**

- Bandwidth limits and compartmentalization
- Timed challenge-response and memory-occupation challenges

**No new hardware needed**

- Timed challenge-response and memory-occupation challenges


## Attack testing

Published attempts to break a system, including those that found failures. Testing history does not establish that open flaws are resolved.

**Testing history**

- Bandwidth limits and compartmentalization: Analysis
- Timed challenge-response and memory-occupation challenges / SAGE: Analysis


## Limits

**Open significant flaws**

- Low-communication training reduces the bandwidth training needs (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-1) [2][6][7]. DiLoCo matched fully synchronous training on 8 workers while communicating 500 times less. Rahman writes that this family of methods theoretically allows large-scale training with less than 100 Mbps. Lucid includes these methods in its bounds, but notes that extreme activation compression, architectures with unusually small inter-layer widths, or modular paradigms could erode the margin.
- Operator control of pod routing collapses the bound (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-2) [2]. Lucid's analysis finds that if the operator can freely assign pods to routers, it could dedicate a whole cell of 100 or more pods to one pipeline stage. The bound then falls to about 90–220x uncompressed and as low as about 25x with compression. The proposed mitigation, auditor-controlled random assignment that is periodically re-randomized, has not been implemented.
- Undeclared local storage raises per-pod capacity (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-3) [2]. More memory or storage per pod helps an adversary. Lucid requires per-pod storage to be declared, capped and physically inspected.
- Training within one pod is not covered (open question, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-4) [2]. Lucid's bounds concern pre-training models larger than the pods are sized for. Training models that fit in one pod, fine-tuning and reinforcement-learning post-training within one pod are outside the modelled threat.
- Parallel scale-up switches are hard enforcement points (theoretical argument, in Bandwidth limits and compartmentalization; https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/#flaw-5) [5]. In GB200 topologies, GPUs reach GPUs in other nodes through NVSwitches without a NIC on the path. Amodo notes that limits are hard to enforce there because many switches work in parallel, so compromising one or two would bypass the limit.

**Family finding context**

- Context for SAGE; applicability depends on the finding's scope. Timing-based software attestation has been broken in practice (demonstrated attack, in Timed challenge-response and memory-occupation challenges; https://trustbutveri.fyi/mechanisms/timed-challenge-response/#flaw-1) [9][10]. Castelluccia et al. implemented two generic attacks, one based on a return-oriented rootkit and one on code compression, together with specific attacks on SWATT and ICE-based schemes, on commodity sensor nodes. They conclude that secure time-based attestation is "very difficult, if not impossible, to design correctly". The attacks target embedded schemes, not AI accelerators.

  Response: Perrig and van Doorn, two of the designers of SWATT and ICE, replied in August 2010. They argue that the rootkit attack defeats a naive implementation, not a property the schemes claim, and that the SWATT attack was run on a re-implementation on a chip with eight times the program memory, where SWATT's own chip is almost always full of code. They accept that the attack on ICE works.
- Context for SAGE; applicability depends on the finding's scope. Remote memory narrows the timing margin (theoretical argument, in Timed challenge-response and memory-occupation challenges; https://trustbutveri.fyi/mechanisms/timed-challenge-response/#flaw-2) [3]. Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges.

  Related mechanism: Bandwidth limits and compartmentalization (R2, in the proposal). Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced.
- Context for SAGE; applicability depends on the finding's scope. Error rates not quantified (open question, in Timed challenge-response and memory-occupation challenges; https://trustbutveri.fyi/mechanisms/timed-challenge-response/#flaw-3) [11]. Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified.

**Open minor flaws**

- Self-modifying code limits the timing margin (open question, in SAGE; https://trustbutveri.fyi/implementations/sage-gpu-attestation/#flaw-1) [8]. The authors report that their implementation reaches 75% of maximum GPU utilisation when the checksum uses self-modifying code, and that this limits the time difference caused by an adversary who inserts instructions into the checksum loop. They note that other cache-eviction strategies could raise utilisation.


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open flaw or a dependency. Pointers, not recommendations: each brings its own readiness level and flaws, and none is claimed to close a flaw.

- **Tamper evidence for verifier devices** (R2 Demonstrated, assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence)
  - Bandwidth limits and compartmentalization waits on it: Shaping devices and routing assignments must be trusted by both parties; Amodo has not yet fully analysed resilience to a compromised DPU.
- **Network taps and certifiers** (R1 Proposed, assessed for committing a complete record of cluster traffic, so declared inference can be checked)
  - Bandwidth limits and compartmentalization waits on it: The verifier must know that all traffic leaving a pod crosses the capped, monitored links.


## Dependencies

**Missing prerequisites**

- Tamper evidence for verifier devices (R2 Demonstrated, assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence), needed by Bandwidth limits and compartmentalization

**Blockers**

- Bandwidth limits and compartmentalization: No cap that a verifier can check has been implemented or red-teamed. (adversarial validation) [2]
- Bandwidth limits and compartmentalization: The verifier must know that all traffic leaving a pod crosses the capped, monitored links. (coverage & hidden compute; waits on Network taps and certifiers) [3]
- Bandwidth limits and compartmentalization: Shaping devices and routing assignments must be trusted by both parties; Amodo has not yet fully analysed resilience to a compromised DPU. (hardware trust; waits on Tamper evidence for verifier devices) [2][5]
- Bandwidth limits and compartmentalization: Advances in low-communication training could shrink the margin that the cap enforces. (capacity bounds) [2][6][7]
- Timed challenge-response and memory-occupation challenges: The verifier must know the exact hardware configuration of the GPU. (hardware trust) [8]
- Timed challenge-response and memory-occupation challenges: The verifier runs in an SGX enclave on the same host as the GPU, so the scheme inherits trust in that enclave. (hardware trust) [8]


## What the verifier sees

- Model weights: shown by none; depends on the design for none; hidden by none; not involved in Bandwidth limits and compartmentalization; unspecified for Timed challenge-response and memory-occupation challenges.
- Inputs and outputs: shown by none; depends on the design for none; hidden by none; not involved in Bandwidth limits and compartmentalization; unspecified for Timed challenge-response and memory-occupation challenges.
- Training data: shown by none; depends on the design for none; hidden by none; not involved in Bandwidth limits and compartmentalization; unspecified for Timed challenge-response and memory-occupation challenges.

## Implementations

- Bandwidth limits and compartmentalization: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [RAND secure inference data center (SIDC) design](https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/) (R1, proposed architecture)
- Timed challenge-response and memory-occupation challenges: [Data-centre memory challenging](https://trustbutveri.fyi/implementations/data-centre-memory-challenging/) (R1, proposed architecture); [GPU contention probes](https://trustbutveri.fyi/implementations/gpu-contention-probes/) (R2, research prototype); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture); [SAGE](https://trustbutveri.fyi/implementations/sage-gpu-attestation/) (R2, research prototype); [VRAM-residency challenge](https://trustbutveri.fyi/implementations/vram-residency-challenge/) (R2, research prototype)

## Sources

1. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
2. Traffic Shaping for Workload Classification, Lucid Computing (2026). https://lucidcomputing.substack.com/p/traffic-shaping-for-workload-classification
3. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
4. De-risking Interconnect Limits for AI Verification, A. Scher et al. (2026). https://techgov.intelligence.org/blog/de-risking-interconnect-limits-for-ai-verification
5. The Tray as a Bandwidth Boundary, Amodo Design (2026). https://amododesign.com/notes/2026-03-16-dpu-bandwidth-limiter/
6. DiLoCo: Distributed Low-Communication Training of Language Models, A. Douillard et al. (2024). https://arxiv.org/abs/2311.08105
7. Does Distributed Training Undermine Compute Governance?, R. Rahman (2026). https://arxiv.org/abs/2605.29359
8. SAGE: Software-based Attestation for GPU Execution, A. Ivanov et al. (2023). https://www.usenix.org/conference/atc23/presentation/ivanov
9. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). https://s3.eurecom.fr/docs/ccs09_Castelluccia.pdf
10. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). https://netsec.ethz.ch/publications/papers/perrig-ccs-refutation.pdf
11. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). https://arxiv.org/abs/2602.09369