# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-09. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0012,M-0017&implementations=M-0017:I-0011

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's development status, security evidence and findings. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and findings) and https://trustbutveri.fyi/about/readiness/ (development status).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

None set. Every mechanism on the map was available.

## Overview

One row per mechanism, read from its record. Open failures: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees. Findings are grouped as known failures, scope limitations and open questions. Only known failures count as failures. Counts are an inventory of published findings, not a risk score.

| Mechanism | Development | Security evidence | Prover | Attack testing | Hardware | Open failures | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Hardware-attested weight binding | Operational use | Published attack testing | Semi-trusted | Independent red-team | Existing features | 1 / 0 / 0 | hidden | unspecified | not involved |
| Tamper evidence for verifier devices / AI 2040 inference-only verification stack | Proposed | No published adversarial analysis recorded | Adversarial | None | Retrofit device | 0 / 1 / 0 | unspecified | unspecified | unspecified |

## Claims

No claims chosen.

## Mechanisms

### Hardware-attested weight binding

Checks that a hardware enclave serves committed model weights, by attesting software that tests the weights against a hash commitment when they are read. ([Hardware-attested weight binding](https://trustbutveri.fyi/mechanisms/model-identity-attestation/))

- Assessment: mechanism family.
- Development: Operational use (legacy code R3), assessed for hardware-attested weight binding showing users that a service runs its committed weights.
- Security evidence: Published attack testing. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: required. Attack testing: independent red-team. Category: Cryptographic & computational.
- What the verifier sees: model weights hidden; inputs and outputs unspecified; training data not involved. Verifiers check a hash commitment to the weights, carried in a hardware attestation, and need no access to the weights themselves. The mechanism does not specify whether prompts and outputs are disclosed to a verifier. It involves no training data.

### Tamper evidence for verifier devices

A proposed retrofit that splits data centres into isolated inference units, copies front-end traffic and re-runs random samples to confirm only declared inference runs. ([Tamper evidence for verifier devices](https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/))

- Assessment: selected implementation [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/).
- Development: Proposed (legacy code R1), assessed for showing that retrofitted data centres run only inference.
- Security evidence: No published adversarial analysis recorded. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: required. Attack testing: none. Category: Isolation & system architectures.
- What the verifier sees: model weights unspecified; inputs and outputs unspecified; training data unspecified. This Explorer has no asset-specific exposure assessment for this implementation. Check its source and deployment assumptions.


## Properties

**Operational use**

- Hardware-attested weight binding: Operational use (legacy code R3), assessed for hardware-attested weight binding showing users that a service runs its committed weights

**Built for an adversarial prover**

- Tamper evidence for verifier devices

**No new hardware needed**

- Hardware-attested weight binding

**Failures since mitigated**

- Launch-state attestation does not by itself cover weights loaded later (in Hardware-attested weight binding) [1][11]


## Attack testing

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

**Testing history**

- Hardware-attested weight binding: Independent red-team


## Limits

**Open critical failures**

- Underlying attestation can be forged or relayed (known failure, demonstrated attack, in Hardware-attested weight binding; https://trustbutveri.fyi/mechanisms/model-identity-attestation/evidence/flaws/1/) [2][3][7][8][9][10]. Inherited finding. Critical for weight binding against an operator with physical access to affected hardware, or with control of the hypervisor on an AMD SEV-SNP platform without AMD's fixes. PAL*M excludes physical attacks, and Tinfoil acknowledges this boundary. The enclave route inherits the platform-specific TEE attestation failures. Intel TDX forgery and H100 relay were demonstrated with physical access and host control. Battering RAM defeated AMD SEV-SNP attestation on DDR4 servers; RMPocalypse did so from malicious host software on platforms without AMD's fixes. These demonstrate failures of the trust roots, not of each model-commitment protocol. Related finding: https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/1/.

  Response: The TEE.fail authors report that physical interposer attacks are outside Intel's and AMD's threat models. AMD reports fixes for RMPocalypse.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, not in the proposal). A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.

**Open significant failures**

- A recomputation family degrades against prompt-controlling adversaries (known failure, demonstrated attack, in AI 2040 inference-only verification stack; https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/evidence/flaws/3/) [13][14][18][19]. The plan's companion page names DiFR among the recomputation schemes being tested. An independent study found that Gumbel-based inference verification, the family that includes Token-DiFR, leaks roughly twice as many bits per token when the adversary chooses prompts that disrupt the text's structure, across six models of 1 to 32 billion parameters. The slowdown it imposes on a hidden-signalling adversary falls from 146–254 times under benign prompts to 60–118 times. The attack weakens the bound on hidden information in outputs, which the plan relies on to keep undeclared results from leaving.

**Family finding context**

- Context for AI 2040 inference-only verification stack. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there. Seals are often defeated with simple methods (known failure, demonstrated attack, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/evidence/flaws/1/) [20][21]. Mechanism-class evidence. Published defeats of general security seals. They warn about proposed verifier-device seals, but do not demonstrate defeat of an AI verification enclosure or sensor. In 1996 a Los Alamos vulnerability assessment defeated all 94 security seals it examined, with 132 defeats in total, using rapid, inexpensive, low-tech methods. It found that seal cost did not predict security. In 2001 Johnston reported that high-tech seals are often easier to defeat than low-tech ones.
- Context for AI 2040 inference-only verification stack. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there. Security depends on inspection protocols (scope limitation, theoretical argument, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/evidence/flaws/2/) [21][22]. Mechanism-class evidence. An inspection and protocol requirement drawn from safeguards and enclosure studies, not a reported break of a deployed AI verifier. Johnston argues that a seal is no better than the protocols for using it, and that inspectors are usually given little useful information on how to detect tampering. The Sandia survey notes that larger enclosures are hard to inspect fully and that sensor data must be authenticated.
- Context for AI 2040 inference-only verification stack. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there. Attack classes outside published models (known failure, open question, in Tamper evidence for verifier devices; https://trustbutveri.fyi/mechanisms/tamper-evidence-for-verifier-devices/evidence/flaws/3/) [23][24][25]. Mechanism-class evidence. The radio compensation result is emulated using measured channel data under a known-reference attacker model. It is not a physical bypass demonstration against an AI verifier enclosure. The authors of the batteryless cover say they cannot assess chemical-solvent attacks, which exceed their expertise, and deem cover removal impractical. Anti-Tamper Radio's reference can drift as the environment or measurement system ages; the authors suggest gradually renewing the reference. A 2025 follow-up by some of the same authors shows, by emulation on measured channel data, that an attacker who knows the reference channel and the needle's effect on it could inject a signal that cancels the change caused by a needle insertion. It proposes a reconfigurable intelligent surface that randomizes the channel as a countermeasure.

**Scope limitations**

- For private models, a user can confirm consistency but not content (scope limitation, open question, in Hardware-attested weight binding; https://trustbutveri.fyi/mechanisms/model-identity-attestation/evidence/flaws/3/) [1][12]. When weights are not published, users can check that the same root hash is served each time, but not what the model is. Pairing the hash with an attested evaluation, as in Attestable Audits, is one proposed remedy.
- The recomputation server must be trusted (scope limitation, theoretical argument, in AI 2040 inference-only verification stack; https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/evidence/flaws/1/) [13][14][16]. The plan calls the integrity of the recomputation server an extremely important aspect, and its argument that sampling verifies all outputs assumes that the server's computations and outputs can be trusted. The companion page notes that the server sits inside the prover's facility, possibly under the prover's physical control, and that hardening it against integrity attacks needs significant research. Amodo rates recomputation-server security as not on track.
- Spare compute is not verified (scope limitation, theoretical argument, in AI 2040 inference-only verification stack; https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/evidence/flaws/2/) [13]. The plan states that it does not verify that spare compute is unused for unapproved workloads, because this seems very challenging. It relies instead on side-channel bounds and memory wipes, so that the only results that persist are verified inference outputs.

**Not yet demonstrated**

- Tamper evidence for verifier devices: Proposed (legacy code R1), assessed for showing that retrofitted data centres run only inference


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open failure or a dependency. Pointers, not recommendations: each brings its own readiness level and findings, and none is claimed to close a failure.

- **Hardware-enabled guarantees (flexHEG) and guarantee processors** (Proposed (legacy code R1), assessed for checking and enforcing training-compute limits on chips, against adversaries up to states)
  - Bears on the open critical failure "Underlying attestation can be forged or relayed" in Hardware-attested weight binding. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
- **TEE remote attestation for AI workloads** (Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware)
  - Hardware-attested weight binding waits on it: Attestation that resists physical attackers, for the enclave variant.
- **Memory wiping and proofs of secure erasure** (Proposed (legacy code R1), assessed for showing that no data from earlier work persists in memory the wipe reaches)
  - Tamper evidence for verifier devices waits on it: Memory wiping may use existing algorithms, but hardware testing is at an early stage.
- **Network taps and certifiers** (Proposed (legacy code R1), assessed for committing a complete record of cluster traffic, so declared inference can be checked)
  - Tamper evidence for verifier devices waits on it: Passive optical taps work at 400G, but the 800G and 1600G line rates now arriving in data centres are undemonstrated.
- **Side-channel suppression for isolated facilities** (Proposed (legacy code R1), assessed for bounding physical covert channels out of a verified enclosure)
  - Tamper evidence for verifier devices waits on it: There is no plan yet for quickly scaling side-channel defences on a frontier cluster; only early theoretical pieces exist.
- **Whole-workload recomputation (reproducible packets)** (Proposed (legacy code R1), assessed for recomputing whole workloads to show a cluster runs only declared inference)
  - Tamper evidence for verifier devices waits on it: A fully reproducible inference stack needs substantial software and tooling, and per-packet network reproducibility may need considerable software, firmware and possibly hardware work.
- **Sampled inference recomputation** (Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision)
  - Tamper evidence for verifier devices depends on it.


## Dependencies

**Missing prerequisites**

- TEE remote attestation for AI workloads (Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware), needed by Hardware-attested weight binding
- Sampled inference recomputation (Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision), needed by Tamper evidence for verifier devices
- Whole-workload recomputation (reproducible packets) (Proposed (legacy code R1), assessed for recomputing whole workloads to show a cluster runs only declared inference), needed by Tamper evidence for verifier devices

**Blockers**

- Hardware-attested weight binding: Attestation that resists physical attackers, for the enclave variant. (hardware trust; waits on TEE remote attestation for AI workloads) [7]
- Tamper evidence for verifier devices: A fully reproducible inference stack needs substantial software and tooling, and per-packet network reproducibility may need considerable software, firmware and possibly hardware work. (performance & compatibility; waits on Whole-workload recomputation (reproducible packets)) [14]
- Tamper evidence for verifier devices: Passive optical taps work at 400G, but the 800G and 1600G line rates now arriving in data centres are undemonstrated. (performance & compatibility; waits on Network taps and certifiers) [14]
- Tamper evidence for verifier devices: Checking that taps are correctly installed and stay in place at scale is not a solved problem, and hardening the recomputation server inside the prover's facility needs significant research. (hardware trust; waits on Tamper evidence for verifier devices) [14][16]
- Tamper evidence for verifier devices: There is no plan yet for quickly scaling side-channel defences on a frontier cluster; only early theoretical pieces exist. (coverage & hidden compute; waits on Side-channel suppression for isolated facilities) [14]
- Tamper evidence for verifier devices: Memory wiping may use existing algorithms, but hardware testing is at an early stage. (coverage & hidden compute; waits on Memory wiping and proofs of secure erasure) [14]
- Tamper evidence for verifier devices: Robust red-teaming of recomputation schemes has not started, and most algorithm development remains academic. (adversarial validation) [14][16]


## What the verifier sees

- Model weights: shown by none; depends on the design for none; hidden by Hardware-attested weight binding; not involved in none; unspecified for Tamper evidence for verifier devices.
- Inputs and outputs: shown by none; depends on the design for none; hidden by none; not involved in none; unspecified for Hardware-attested weight binding and Tamper evidence for verifier devices.
- Training data: shown by none; depends on the design for none; hidden by none; not involved in Hardware-attested weight binding; unspecified for Tamper evidence for verifier devices.

## Implementations

- Hardware-attested weight binding: [Attestable Audits](https://trustbutveri.fyi/implementations/attestable-audits/) (R2, research prototype); [PAL*M](https://trustbutveri.fyi/implementations/palm/) (R2, research prototype); [Tinfoil model identity (Modelwrap)](https://trustbutveri.fyi/implementations/tinfoil-model-identity/) (R3, product)
- Tamper evidence for verifier devices: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture)

## Sources

1. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). https://tinfoil.sh/blog/2026-02-03-proving-model-identity
2. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). https://arxiv.org/abs/2601.16199
3. A primer on secure enclaves, Tinfoil (2026). https://docs.tinfoil.sh/verification/secure-enclave-primer
4. Backend infrastructure, Tinfoil (2026). https://docs.tinfoil.sh/verification/attestation-architecture
5. How verification works in Tinfoil, Tinfoil (2026). https://docs.tinfoil.sh/verification/verification-in-tinfoil
6. modelwrap: Reproducible dm-verity read-only image of Huggingface models, Tinfoil (2026). https://github.com/tinfoilsh/modelwrap
7. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). https://tee.fail/
8. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). https://batteringram.eu/
9. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). https://rmpocalypse.github.io/
10. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3020.html
11. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). https://techgov.intelligence.org/blog/on-tees-for-privacy-preserving-monitoring-in-ai-governance
12. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). https://arxiv.org/abs/2506.23706
13. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
14. Get Involved in Verification, AI Futures Project (2026). https://ai-2040.com/supplements/verification-plan/get-involved
15. Verifying international AI deals: Plan A, the state-of-play, and what you can do to help, T. Milton et al. (2026). https://amodo.substack.com/p/verifying-international-ai-deals
16. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). https://amododesign.com/ai-verification/plan-a-sitrep/
17. Fitting a Network TAP to our Inference Verification Prototype, Amodo Design (2026). https://amododesign.com/notes/2026-09-15-network-tap-inference-verification/
18. Verifying LLM Inference to Detect Model Weight Exfiltration, R. Rinberg et al. (2025). https://arxiv.org/abs/2511.02620
19. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). https://arxiv.org/abs/2608.23375
20. Physical Security and Tamper-Indicating Devices, R. G. Johnston & A. R. E. Garcia (1996). https://www.osti.gov/servlets/purl/459707
21. Tamper Detection for Safeguards and Treaty Monitoring: Fantasies, Realities, and Potentials, R. G. Johnston (2001). https://www.nonproliferation.org/wp-content/uploads/npr/81john.pdf
22. Tamper-Indicating Enclosures, A Current Survey, H. A. Smartt & Z. N. Gastelum (2015). https://www.osti.gov/servlets/purl/1256541
23. Secure Physical Enclosures from Covers with Tamper-Resistance, V. Immler et al. (2019). https://tches.iacr.org/index.php/TCHES/article/view/7334
24. Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems, P. Staat et al. (2022). https://ieeexplore.ieee.org/document/9833631/
25. Anti-Tamper Radio Meets Reconfigurable Intelligent Surface for System-Level Tamper Detection, M. S. Tabar et al. (2025). https://arxiv.org/abs/2503.14279