# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-09. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0010,M-0001,M-0009,M-0008

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's development status, security evidence and findings. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and findings) and https://trustbutveri.fyi/about/readiness/ (development status).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

None set. Every mechanism on the map was available.

## Overview

One row per mechanism, read from its record. Open failures: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees. Findings are grouped as known failures, scope limitations and open questions. Only known failures count as failures. Counts are an inventory of published findings, not a risk score.

| Mechanism | Development | Security evidence | Prover | Attack testing | Hardware | Open failures | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| On-chip telemetry from timing, memory and performance counters | Research demonstration | Published attack testing | Semi-trusted | Red-teamed | Existing features | 0 / 2 / 0 | depends | depends | depends |
| Sampled inference recomputation | Operational use | Published security analysis | Adversarial | Analysis | None | 0 / 2 / 1 | depends | depends | not involved |
| Hardware-enabled guarantees (flexHEG) and guarantee processors | Proposed | Published security analysis | Adversarial | Analysis | New chip design | 0 / 3 / 0 | hidden | hidden | hidden |
| TEE remote attestation for AI workloads | Operational use | Published attack testing | Semi-trusted | Independent red-team | Existing features | 2 / 3 / 0 | hidden | hidden | hidden |

## Claims

No claims chosen.

## Mechanisms

### On-chip telemetry from timing, memory and performance counters

Uses on-chip measurements, such as task timings, whether data sits in chip memory, and performance counters, as evidence of what AI chips are running. ([On-chip telemetry from timing, memory and performance counters](https://trustbutveri.fyi/mechanisms/on-chip-telemetry/))

- Assessment: mechanism family.
- Development: Research demonstration (legacy code R2), assessed for workload evidence from GPU counters and timing, assuming authentic measurements.
- Security evidence: Published attack testing. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: partial. Attack testing: red-teamed. Category: On-chip & hardware-enabled.
- What the verifier sees: model weights depends; inputs and outputs depends; training data depends. Counters do not read weights or data, but richer counters can leak secrets through side channels.

### Sampled inference recomputation

A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match. ([Sampled inference recomputation](https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/))

- Assessment: mechanism family.
- Development: Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: none. Prover cooperation: required. Attack testing: analysis. Category: Cryptographic & computational.
- What the verifier sees: model weights depends; inputs and outputs depends; training data not involved. Recomputation needs the weights and sampled requests inside the checking environment. For closed models, the record describes a trusted, confidential environment; disclosure to the verifier depends on that boundary.

### Hardware-enabled guarantees (flexHEG) and guarantee processors

A proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use. ([Hardware-enabled guarantees (flexHEG) and guarantee processors](https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/))

- Assessment: mechanism family.
- Development: Proposed (legacy code R1), assessed for checking and enforcing training-compute limits on chips, against adversaries up to states.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: new chip design. Prover cooperation: required. Attack testing: analysis. Category: On-chip & hardware-enabled.
- What the verifier sees: model weights hidden; inputs and outputs hidden; training data hidden. The guarantee processor sees the chip's traffic inside a sealed enclosure and reports only whether rules were kept.

### TEE remote attestation for AI workloads

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with. ([TEE remote attestation for AI workloads](https://trustbutveri.fyi/mechanisms/tee-remote-attestation/))

- Assessment: mechanism family.
- Development: Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware.
- Security evidence: Published attack testing. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: required. Attack testing: independent red-team. Category: On-chip & hardware-enabled.
- What the verifier sees: model weights hidden; inputs and outputs hidden; training data hidden. The enclave keeps what runs inside it from the host and the verifier; the verifier sees signed measurements. This relies on the chip vendor's hardware.


## Properties

**Operational use**

- Sampled inference recomputation: Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision
- TEE remote attestation for AI workloads: Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware

**Built for an adversarial prover**

- Sampled inference recomputation
- Hardware-enabled guarantees (flexHEG) and guarantee processors

**No new hardware needed**

- On-chip telemetry from timing, memory and performance counters
- Sampled inference recomputation
- TEE remote attestation for AI workloads

**Failures since mitigated**

- Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked) (in TEE remote attestation for AI workloads) [37][38][42][43]


## Attack testing

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

**Testing history**

- On-chip telemetry from timing, memory and performance counters: Red-teamed
- Sampled inference recomputation: Analysis
- Hardware-enabled guarantees (flexHEG) and guarantee processors: Analysis
- TEE remote attestation for AI workloads: Independent red-team


## Limits

**Open critical failures**

- DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop) (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/1/) [4][27][29][30][35][37][41][42]. Mechanism-class evidence. Critical when the verifier must resist physical access plus host control on the affected DDR5 platforms. The Intel demonstrations defeat attestation; TEE.fail's AMD demonstration extracts a guest key, not an AMD attestation key. These results do not cover every TEE architecture. Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges.
  - On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations.
  - On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software.

  A second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery.

  The TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026. PAL*M lists this attack class as out of its scope, and Tinfoil's documentation acknowledges it. Gloria Z calls key extraction through bus interposition "relatively low-hanging fruit" in an international treaty scenario.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, in the proposal). A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
- DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap) (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/2/) [35][36]. Mechanism-class evidence. Critical for the tested DDR4 SGX and SEV-SNP configurations against a physical host attacker. The authors exclude DDR5 from these demonstrations, including TDX servers; the DDR5 attacks have a separate finding. Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host.
  - Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation.
  - WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments.

  Both attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, in the proposal). A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.

**Open significant failures**

- Adversarially disguised fine-tuning partly evades classification (known failure, demonstrated attack, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/2/) [3]. Across 20 evasion strategy families in five monitor-evader rounds, the classifier's accuracy against the most challenging disguised workloads held out from training was 43–87%. White-box LoRA fine-tuning was the only evasion family detected less than half the time. The evaluation covered single nodes, PyTorch-level evasion and NVIDIA hardware.
- Counters leak information about protected workloads (known failure, theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/4/) [4][5]. Performance counters have been used as a side channel against TEEs, for example in CounterSEVeillance. NVIDIA disables performance counters in full confidential-computing mode, stating that they could provide an avenue for side-channel attacks. Richer counters for verification therefore pull against confidentiality.
- Tolerance for numerical noise leaves a covert channel (known failure, demonstrated attack, in Sampled inference recomputation; https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/evidence/flaws/1/) [6][14][17]. Schemes that accept approximate matches can put an upper bound on an adversary's covert bandwidth, but they cannot close the channel. The weight-exfiltration detector cut exfiltratable information to under 0.5%, not to zero, on a 30-billion-parameter mixture-of-experts model under benign prompt traffic. Its authors called the channel's size under adversarial prompts an open empirical question. An independent study showed that an adversary who controls the prompts roughly doubles the bits leaked per token. Across six models, that cut the slowdown from 146–254 times under benign prompts to 60–118 times. The attack widens the exfiltration bound. It does not target the check that outputs match the declared model.

  Related mechanism: Deterministic and bit-exact inference (R3, not in the proposal). Bit-exact inference would remove the numerical tolerance if exact replay can be deployed with the required weights and configuration.
- Some inference optimizations are not covered (known failure, theoretical argument, in Sampled inference recomputation; https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/evidence/flaws/3/) [7][8]. TOPLOC's authors state that it cannot detect speculative decoding in which a cheaper model does the decoding. They did not test whether it distinguishes types of key-value (KV) cache compression. DiFR was evaluated only on sampling from a single model. Its authors sketch an extension to one speculative-decoding algorithm but do not test it.
- State attackers can likely defeat current secure enclosures (known failure, theoretical argument, in Hardware-enabled guarantees (flexHEG) and guarantee processors; https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/evidence/flaws/1/) [21][23]. The flexHEG authors write that "nation-state attackers can likely compromise the best current secure enclosures", and that the marginal cost of circumvention per device is hard to estimate. RAND similarly judges that anti-tamper measures "would not be insurmountable for a determined and well-resourced adversary", although they raise costs and can reveal tampering.
- Firmware-only retrofits rely on Secure Boot, which fault injection can bypass (known failure, theoretical argument, in Hardware-enabled guarantees (flexHEG) and guarantee processors; https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/evidence/flaws/2/) [21]. Part II notes that the most common attack on Secure Boot replaces the firmware and applies a voltage glitch while the signature is being checked. It also notes that sophisticated actors may use microprobing or laser voltage probing to read key registers.
- FLOP accounting can be laundered through external data (known failure, theoretical argument, in Hardware-enabled guarantees (flexHEG) and guarantee processors; https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/evidence/flaws/4/) [21]. Results of earlier or parallel workloads could be hidden in the "external data" fed to a device, which would falsify the total FLOP count unless the inputs are explained or time delays are imposed.
- H100 attestation not bound to a specific confidential VM (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/4/) [29]. Mechanism-class evidence. The demonstration combines a genuine H100 report with forged Intel TDX evidence. It depends on the CPU attestation already being defeated; a GPU report alone does not demonstrate that an intact CPU-to-GPU trust chain was bypassed. The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side.
- Side channels and other attacks by the host on CPU and GPU TEEs (known failure, demonstrated attack, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/5/) [4][26][27][44][45]. Mechanism-class evidence. The cited studies concern particular CPU and GPU platforms and attack prerequisites. StackWarp has AMD microcode patches; the open class-level entry does not mean every cited defect is unmitigated or applies to every TEE-backed implementation. PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope. Attestable Audits proposes revoking vulnerable enclave images. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA.
- Root of trust concentrated in a few hardware vendors (known failure, theoretical argument, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/8/) [4][26][48][49]. Mechanism-class evidence. Vendor trust is an assumption of the attestation chain. The root-seed extraction study concerns AMD EPYC Milan and firmware downgrade with privileged host and platform-flash access; it is not evidence of the same failure on Intel, NVIDIA or all AMD generations. The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip. Attestable Audits notes that the approach holds only "as long as the vendor of the secure hardware is trusted". A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021.

**Open minor failures**

- Mixed hardware widens the honest baseline (known failure, open question, in Sampled inference recomputation; https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/evidence/flaws/4/) [7]. When honest reference runs span different GPU types, the spread of benign scores grows. In DiFR's tests on Qwen3-30B-A3B, pooling A100 and H200 runs left Token-DiFR unable to separate the two smallest tested changes, a temperature of 1.1 instead of 1.0 and a simulated top-2 sampling bug, at the target false-positive rate, while cross-entropy separated them. Matched provider and verifier environments, or pooling that weights rare large deviations, restored detection.

**Scope limitations**

- Software-read telemetry can be forged by the operator (scope limitation, theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/1/) [1][3]. NVML-based classification assumes trustworthy telemetry. Without a tamper-resistant read path, an authenticated telemetry channel and secure boot of the monitoring software, an operator who controls the full software stack could forge counter values. Monfared et al. start from the same premise: current GPUs expose little trusted telemetry and can be modified or virtualized.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, in the proposal). A guarantee processor on the chip would give the tamper-resistant, authenticated telemetry path the flaw says is missing.
- Timing challenges do not identify the individual chip (scope limitation, theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/3/) [1]. GEMM and VDF challenges can be answered by identical GPUs elsewhere, and floating-point fingerprints distinguish GPU models, not individual devices. GPU virtualization adds timing leakage that prevents attributing compute use.
- Only recorded traffic is checked (scope limitation, theoretical argument, in Sampled inference recomputation; https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/evidence/flaws/2/) [6][18]. Recomputation checks that recorded, declared workloads are correct. It cannot show that the record is complete. The published schemes do not cover hidden workloads run on the same compute, or substituted work. Rinberg et al. say their exfiltration-detection scheme cannot stand alone.

  Related mechanism: Network taps and certifiers (R1, not in the proposal). Taps copy and hash all traffic on the monitored links, which bears on whether the traffic record is complete. They do not show what else ran on the same chips.
- Many important rules cannot be checked on-chip (scope limitation, theoretical argument, in Hardware-enabled guarantees (flexHEG) and guarantee processors; https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/evidence/flaws/3/) [20][22]. Malicious intent "is not a technical property observable on-chip", and misuse depends on what is done with a computation's results. A guarantee processor cannot easily tell whether a network is the whole system or one expert in a mixture-of-experts system. Part III judges that a fully local ruleset "may not be entirely feasible" for the same reason.
- Coverage stops at flexHEG-equipped chips (scope limitation, open question, in Hardware-enabled guarantees (flexHEG) and guarantee processors; https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/evidence/flaws/6/) [20][22]. Motivated actors will always be able to use some compute that is not flexHEG-equipped. Recalling existing consumer GPUs would likely be impractical, and reaching perfect coverage, or conclusively proving that no secret government data centres exist, would be "practically quite difficult".

  Related mechanism: Chip registries and manufacturing records (R1, not in the proposal). Accounts for which chips exist and who holds them.

  Related mechanism: Remote detection of data centres (R1, not in the proposal). Looks for undeclared facilities that hold other chips.
- Attestation covers launch state, and measurements can be incomplete (scope limitation, theoretical argument, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/6/) [4][39][40][46][47]. Mechanism-class evidence. A general measurement-boundary limitation. The concrete WhatsApp configuration findings were fixed before launch; Apple's research-environment configuration flaw was also fixed. Their fixes do not remove the need to bind each deployment's runtime inputs. Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself". Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged.
- Deployment-level attestation does not cover the whole chip (scope limitation, theoretical argument, in TEE remote attestation for AI workloads; https://trustbutveri.fyi/mechanisms/tee-remote-attestation/evidence/flaws/7/) [4]. Mechanism-class evidence. A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request. An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan". This matters most for negative claims such as the absence of training.

  Related mechanism: On-chip telemetry from timing, memory and performance counters (R2, in the proposal). On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give.

**Open questions**

- No quantified error rates or formal thresholds for timing primitives (open question, open question, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/5/) [1]. Monfared et al. state that false-positive and false-negative rates are not quantified and leave hardware-specific formal thresholds to future work.
- Supply-chain diversion and hidden backdoors (open question, open question, in Hardware-enabled guarantees (flexHEG) and guarantee processors; https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/evidence/flaws/5/) [21][22]. Components could be diverted before a guarantee processor is added, and backdoors could be introduced during design or manufacturing. Open-source designs and physical scans of randomly selected chips are proposed as countermeasures. Part III proposes international oversight of production and extensive testing of a random sample of finished devices.

  Related mechanism: Chip registries and manufacturing records (R1, not in the proposal). Records each chip's identity and owner from the fab onwards, which bears on diversion before a guarantee processor is fitted. It does not address hidden backdoors.

**Not yet demonstrated**

- Hardware-enabled guarantees (flexHEG) and guarantee processors: Proposed (legacy code R1), assessed for checking and enforcing training-compute limits on chips, against adversaries up to states

**Need new chip designs**

- Hardware-enabled guarantees (flexHEG) and guarantee processors


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open failure or a dependency. Pointers, not recommendations: each brings its own readiness level and findings, and none is claimed to close a failure.

- **Deterministic and bit-exact inference** (Operational use (legacy code R3), assessed for reproducing open-model inference from receipts in Gensyn's information-market service)
  - Bears on the open significant failure "Tolerance for numerical noise leaves a covert channel" in Sampled inference recomputation. Bit-exact inference would remove the numerical tolerance if exact replay can be deployed with the required weights and configuration.
- **Tamper evidence for verifier devices** (Research demonstration (legacy code R2), assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence)
  - Hardware-enabled guarantees (flexHEG) and guarantee processors waits on it: State-level attackers who hold the hardware can likely compromise the best current secure enclosures.
- **Chip registries and manufacturing records** (Proposed (legacy code R1), assessed for a checkable record of which chips were made and who declared owning them)
  - Hardware-enabled guarantees (flexHEG) and guarantee processors waits on it: Governing all relevant chips depends on knowing where they are, through chip registries and detection of undeclared facilities.
- **Network taps and certifiers** (Proposed (legacy code R1), assessed for committing a complete record of cluster traffic, so declared inference can be checked)
  - Sampled inference recomputation waits on it: In tap-based retrofit designs, recording all inference traffic needs network taps and recomputation servers that can ingest it, in the worst case one recomputation-server network interface per inference front-end interface.


## Dependencies

**Missing prerequisites**

- Chip registries and manufacturing records (Proposed (legacy code R1), assessed for a checkable record of which chips were made and who declared owning them), needed by Hardware-enabled guarantees (flexHEG) and guarantee processors

**Shared foundations**

- TEE remote attestation for AI workloads, relied on by On-chip telemetry from timing, memory and performance counters and Hardware-enabled guarantees (flexHEG) and guarantee processors (in the proposal)
- Hardware-enabled guarantees (flexHEG) and guarantee processors, relied on by On-chip telemetry from timing, memory and performance counters and TEE remote attestation for AI workloads (in the proposal)

**Blockers**

- On-chip telemetry from timing, memory and performance counters: Shipping accelerators need a tamper-resistant, authenticated telemetry path. (hardware trust; waits on Hardware-enabled guarantees (flexHEG) and guarantee processors) [2][3]
- On-chip telemetry from timing, memory and performance counters: NVIDIA's full confidential-computing mode disables the hardware performance counters its profiling tools use, so telemetry that needs them conflicts with it. (privacy & leakage) [4][5]
- On-chip telemetry from timing, memory and performance counters: Continuous challenge puzzles cost power and throughput on production workloads. (performance & compatibility) [1]
- On-chip telemetry from timing, memory and performance counters: Evaluation has not gone beyond single nodes, framework-level evasion and one vendor's hardware. (adversarial validation) [3]
- Sampled inference recomputation: In tap-based retrofit designs, recording all inference traffic needs network taps and recomputation servers that can ingest it, in the worst case one recomputation-server network interface per inference front-end interface. (coverage & hidden compute; waits on Network taps and certifiers) [13][50]
- Sampled inference recomputation: In retrofit designs, the recomputation server must sit inside the prover's data centre, possibly under the prover's physical control, and still be protected from a compromised provider, which Amodo rates 'not on track'. (hardware trust) [6][13]
- Sampled inference recomputation: No independent red-team of a recomputation consistency check has been published (the one independent attack study targets the weight-exfiltration bound), and Amodo rates recomputation red-teaming 'not started'. (adversarial validation) [13][14]
- Sampled inference recomputation: Tolerance-based checks need calibration on trusted hardware and exact knowledge of the provider's sampling procedure, and in one prototype a sampling-implementation mismatch produced large spurious differences. (performance & compatibility) [7][12]
- Sampled inference recomputation: The verifier needs the model weights, so checking a closed-weights model requires a trusted, confidential recomputation environment, which the retrofit designs place inside the prover's facility. (privacy & leakage) [7][18][19]
- Hardware-enabled guarantees (flexHEG) and guarantee processors: Integrated flexHEG needs substantial help from the accelerator manufacturer, and the authors estimate 3.7–7.9 years, from when the manufacturer starts work, for such hardware to displace other accelerators in frontier development. (access & governance) [21]
- Hardware-enabled guarantees (flexHEG) and guarantee processors: State-level attackers who hold the hardware can likely compromise the best current secure enclosures. (hardware trust; waits on Tamper evidence for verifier devices) [21][23]
- Hardware-enabled guarantees (flexHEG) and guarantee processors: Rival states would need to trust the design and manufacture of guarantee processors and enclosures, for example through open design, redundant processors from each side or oversight of production. (hardware trust) [20][22]
- Hardware-enabled guarantees (flexHEG) and guarantee processors: Restricting future rule updates would need a formal language for rules, which the authors judge most likely infeasible for early flexHEG versions. (protocol soundness) [20]
- Hardware-enabled guarantees (flexHEG) and guarantee processors: Governing all relevant chips depends on knowing where they are, through chip registries and detection of undeclared facilities. (coverage & hidden compute; waits on Chip registries and manufacturing records) [22]
- TEE remote attestation for AI workloads: Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware. (hardware trust; waits on Hardware-enabled guarantees (flexHEG) and guarantee processors) [5][21][29][35][36][41]
- TEE remote attestation for AI workloads: Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide. (coverage & hidden compute; waits on On-chip telemetry from timing, memory and performance counters) [4]
- TEE remote attestation for AI workloads: Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's April 2026 release notes list no multi-node confidential mode. (performance & compatibility) [5][51]
- TEE remote attestation for AI workloads: Rival parties have not agreed on trust roots and key provenance they would accept. (access & governance) [4]
- TEE remote attestation for AI workloads: CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost. (performance & compatibility) [26]


## What the verifier sees

- Model weights: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters and Sampled inference recomputation; hidden by Hardware-enabled guarantees (flexHEG) and guarantee processors and TEE remote attestation for AI workloads; not involved in none; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters and Sampled inference recomputation; hidden by Hardware-enabled guarantees (flexHEG) and guarantee processors and TEE remote attestation for AI workloads; not involved in none; unspecified for none.
- Training data: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by Hardware-enabled guarantees (flexHEG) and guarantee processors and TEE remote attestation for AI workloads; not involved in Sampled inference recomputation; unspecified for none.

## Implementations

- On-chip telemetry from timing, memory and performance counters: none on the map
- Sampled inference recomputation: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [DiFR (Divergence From Reference)](https://trustbutveri.fyi/implementations/difr/) (R2, research prototype); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture); [SASH confidential network logger](https://trustbutveri.fyi/implementations/sash-confidential-network-logger/) (R1, research prototype); [TOPLOC](https://trustbutveri.fyi/implementations/toploc/) (R3, open-source project)
- Hardware-enabled guarantees (flexHEG) and guarantee processors: none on the map
- TEE remote attestation for AI workloads: [Apple Private Cloud Compute](https://trustbutveri.fyi/implementations/apple-private-cloud-compute/) (R3, product); [Attestable Audits](https://trustbutveri.fyi/implementations/attestable-audits/) (R2, research prototype); [Cove](https://trustbutveri.fyi/implementations/cove/) (R2, open-source project); [PAL*M](https://trustbutveri.fyi/implementations/palm/) (R2, research prototype); [Tinfoil model identity (Modelwrap)](https://trustbutveri.fyi/implementations/tinfoil-model-identity/) (R3, product)

## Sources

1. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). https://arxiv.org/abs/2602.09369
2. Guaranteeable Memory: An HBM-Based Chiplet for Verifiable AI Workloads, J. Petrie (2025). https://openreview.net/forum?id=uc79kOv0MV
3. Detecting Hidden ML Training With Zero-Overhead Telemetry, R. Rahman & S. Tajdari (2026). https://arxiv.org/abs/2606.19262
4. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). https://techgov.intelligence.org/blog/on-tees-for-privacy-preserving-monitoring-in-ai-governance
5. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). https://docs.nvidia.com/nvidia-secure-ai-with-blackwell-and-hopper-gpus-whitepaper.pdf
6. Verifying LLM Inference to Detect Model Weight Exfiltration, R. Rinberg et al. (2025). https://arxiv.org/abs/2511.02620
7. DiFR: Inference Verification Despite Nondeterminism, A. Karvonen et al. (2025). https://arxiv.org/abs/2511.20621
8. TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable Inference, J. M. Ong et al. (2025). https://proceedings.mlr.press/v267/ong25a.html
9. PrimeIntellect-ai/toploc (GitHub repository), Prime Intellect (2025). https://github.com/PrimeIntellect-ai/toploc
10. INTELLECT-2: A Reasoning Model Trained Through Globally Decentralized Reinforcement Learning, Prime Intellect Team et al. (2025). https://arxiv.org/abs/2505.07291
11. adamkarvonen/difr (GitHub repository), A. Karvonen (2025). https://github.com/adamkarvonen/difr
12. Scaling Recomputation Inference Verification, Amodo Design (2026). https://amododesign.com/notes/2026-09-02-scaling-recomputation-inference-verification/
13. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). https://amododesign.com/ai-verification/plan-a-sitrep/
14. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). https://arxiv.org/abs/2608.23375
15. SYNTHETIC-2 Release: Four Million Collaboratively Generated Reasoning Traces, Prime Intellect (2025). https://www.primeintellect.ai/blog/synthetic-2-release
16. An Inference Verification Prototype — Stage 1, Amodo Design (2026). https://amododesign.com/notes/2026-06-29-inference-verification-prototype/
17. Bit-Exact AI Inference Verification Without Performance Tradeoffs, N. Cankaya (2026). https://arxiv.org/abs/2606.00279
18. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). https://amododesign.com/notes/2026-06-23-verification-algorithms/
19. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
20. Flexible Hardware-Enabled Guarantees for AI Compute, J. Petrie et al. (2025). https://arxiv.org/abs/2506.15093
21. Technical Options for Flexible Hardware-Enabled Guarantees, J. Petrie & O. Aarne (2025). https://arxiv.org/abs/2506.03409
22. International Security Applications of Flexible Hardware-Enabled Guarantees, O. Aarne & J. Petrie (2025). https://arxiv.org/abs/2506.15100
23. Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090, G. Kulp et al. (2024). https://www.rand.org/pubs/working_papers/WRA3056-1.html
24. Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computing, O. Aarne et al. (2024). https://www.cnas.org/publications/reports/secure-governable-chips
25. Hardware-Enabled Mechanisms for Verifying Responsible AI Development, A. O'Gara et al. (2025). https://arxiv.org/abs/2505.03742
26. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). https://arxiv.org/abs/2506.23706
27. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). https://arxiv.org/abs/2601.16199
28. Now in General Availability: NVIDIA H100 GPUs in Microsoft Azure Confidential Virtual Machines, C. Su (2024). https://blogs.nvidia.com/blog/azure-confidential-vm-h100-general-availability
29. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). https://tee.fail/
30. A primer on secure enclaves, Tinfoil (2026). https://docs.tinfoil.sh/verification/secure-enclave-primer
31. Backend infrastructure, Tinfoil (2026). https://docs.tinfoil.sh/verification/attestation-architecture
32. How verification works in Tinfoil, Tinfoil (2026). https://docs.tinfoil.sh/verification/verification-in-tinfoil
33. modelwrap: Reproducible dm-verity read-only image of Huggingface models, Tinfoil (2026). https://github.com/tinfoilsh/modelwrap
34. Private Cloud Compute: A new frontier for AI privacy in the cloud, Apple Security Engineering and Architecture (SEAR) (2024). https://security.apple.com/blog/private-cloud-compute/
35. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). https://batteringram.eu/
36. WireTap: Breaking Server SGX via DRAM Bus Interposition, A. Seto et al. (2025). https://wiretap.fail/
37. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). https://rmpocalypse.github.io/
38. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3020.html
39. What we learned about TEE security from auditing WhatsApp's Private Inference, Trail of Bits (2026). https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/
40. Meta WhatsApp Private Processing (security review), Trail of Bits (2025). https://trailofbits.com/library/meta-whatsapp-private-processing/
41. DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes, J. De Meulemeester et al. (2026). https://ddropattack.eu/
42. Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP, B. Schlüter et al. (2026). https://www.usenix.org/conference/usenixsecurity26/presentation/schlueter-1
43. SEV-SNP Routing Misconfiguration (AMD-SB-3034), AMD (2026). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3034.html
44. Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing, Z. Gu et al. (2026). https://arxiv.org/abs/2507.02770
45. StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine, R. Zhang et al. (2026). https://www.usenix.org/conference/usenixsecurity26/presentation/zhang-ruiyi
46. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). https://tinfoil.sh/blog/2026-02-03-proving-model-identity
47. Beyond Prompt Injection: Hacking Apple's Private Cloud Compute, D. Selmanaj (2026). https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/
48. Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack, M. Shen & Y. Qin (2026). https://arxiv.org/abs/2605.12990
49. MilanLaunchy Firmware Loader (AMD-SB-3045), AMD (2026). https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3045.html
50. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
51. NVIDIA Trusted Computing Solutions Release Notes (R595 TRD1), NVIDIA (2026). https://docs.nvidia.com/595trd1-trusted-computing-solutions-release-notes.pdf