# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-09. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0010,M-0015&tested=analysis

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's development status, security evidence and findings. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and findings) and https://trustbutveri.fyi/about/readiness/ (development status).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

- **Attack testing: Published analysis.** Keeps mechanisms whose strongest published attack testing is at least this. The strongest published attempt to break the mechanism for its verification use: a security analysis, red-teaming by its developers or collaborators, or a red team independent of them.

24 of 25 mechanisms on the map pass these filters.

## Overview

One row per mechanism, read from its record. Open failures: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees. Findings are grouped as known failures, scope limitations and open questions. Only known failures count as failures. Counts are an inventory of published findings, not a risk score.

| Mechanism | Development | Security evidence | Prover | Attack testing | Hardware | Open failures | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| On-chip telemetry from timing, memory and performance counters | Research demonstration | Published attack testing | Semi-trusted | Red-teamed | Existing features | 0 / 2 / 0 | depends | depends | depends |
| Memory wiping and proofs of secure erasure | Proposed | Published security analysis | Adversarial | Analysis | None | 0 / 1 / 0 | not involved | not involved | not involved |

## Claims

No claims chosen.

## Mechanisms

### On-chip telemetry from timing, memory and performance counters

Uses on-chip measurements, such as task timings, whether data sits in chip memory, and performance counters, as evidence of what AI chips are running. ([On-chip telemetry from timing, memory and performance counters](https://trustbutveri.fyi/mechanisms/on-chip-telemetry/))

- Assessment: mechanism family.
- Development: Research demonstration (legacy code R2), assessed for workload evidence from GPU counters and timing, assuming authentic measurements.
- Security evidence: Published attack testing. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: partial. Attack testing: red-teamed. Category: On-chip & hardware-enabled.
- What the verifier sees: model weights depends; inputs and outputs depends; training data depends. Counters do not read weights or data, but richer counters can leak secrets through side channels.

### Memory wiping and proofs of secure erasure

Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches. ([Memory wiping and proofs of secure erasure](https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/))

- Assessment: mechanism family.
- Development: Proposed (legacy code R1), assessed for showing that no data from earlier work persists in memory the wipe reaches.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: none. Prover cooperation: required. Attack testing: analysis. Category: Isolation & system architectures.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Overwrites memory with verifier-chosen data; it does not handle model data.


## Properties

**Built for an adversarial prover**

- Memory wiping and proofs of secure erasure

**No new hardware needed**

- On-chip telemetry from timing, memory and performance counters
- Memory wiping and proofs of secure erasure


## Attack testing

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

**Testing history**

- On-chip telemetry from timing, memory and performance counters: Red-teamed
- Memory wiping and proofs of secure erasure: Analysis


## Limits

**Open significant failures**

- Adversarially disguised fine-tuning partly evades classification (known failure, demonstrated attack, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/2/) [3]. Across 20 evasion strategy families in five monitor-evader rounds, the classifier's accuracy against the most challenging disguised workloads held out from training was 43–87%. White-box LoRA fine-tuning was the only evasion family detected less than half the time. The evaluation covered single nodes, PyTorch-level evasion and NVIDIA hardware.
- Counters leak information about protected workloads (known failure, theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/4/) [4][5]. Performance counters have been used as a side channel against TEEs, for example in CounterSEVeillance. NVIDIA disables performance counters in full confidential-computing mode, stating that they could provide an avenue for side-channel attacks. Richer counters for verification therefore pull against confidentiality.
- Outside help during challenges (known failure, theoretical argument, in Memory wiping and proofs of secure erasure; https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/evidence/flaws/2/) [8][9]. Classic proofs of secure erasure assume the device is isolated during the protocol. Bursuc et al. relax this to a bound on how close a helper can be, enforced by round-trip times. In data centres, remote memory access has round trips of about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview therefore says verification depends on ruling out RDMA by latency or physical disconnection.

  Related mechanism: Timed challenge-response and memory-occupation challenges (R2, not in the proposal). Timed challenges bound how far away a helper can be by how quickly it must answer.

  Related mechanism: Bandwidth limits and compartmentalization (R2, not in the proposal). Removing or capping links between groups of accelerators limits remote memory access during a challenge.

**Scope limitations**

- Software-read telemetry can be forged by the operator (scope limitation, theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/1/) [1][3]. NVML-based classification assumes trustworthy telemetry. Without a tamper-resistant read path, an authenticated telemetry channel and secure boot of the monitoring software, an operator who controls the full software stack could forge counter values. Monfared et al. start from the same premise: current GPUs expose little trusted telemetry and can be modified or virtualized.

  Related mechanism: Hardware-enabled guarantees (flexHEG) and guarantee processors (R1, not in the proposal). A guarantee processor on the chip would give the tamper-resistant, authenticated telemetry path the flaw says is missing.
- Timing challenges do not identify the individual chip (scope limitation, theoretical argument, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/3/) [1]. GEMM and VDF challenges can be answered by identical GPUs elsewhere, and floating-point fingerprints distinguish GPU models, not individual devices. GPU virtualization adds timing leakage that prevents attributing compute use.
- Memory the wipe cannot reach (scope limitation, open question, in Memory wiping and proofs of secure erasure; https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/evidence/flaws/1/) [10][11]. Amodo's inventory of a GB200 system lists many memory stores beyond GPU HBM and host DRAM. It notes that SSD controller DRAM sits on a private bus that host commands cannot read or write, and that its optimized algorithm leaves 25 GiB of HBM unattested. It also asks how switch memory could be wiped.
- Gap between erased and total memory (scope limitation, theoretical argument, in Memory wiping and proofs of secure erasure; https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/evidence/flaws/3/) [8]. Bursuc et al. note that memory left between the erased region and the device's full memory could hold data, and that their bounds are tighter only against a restricted adversary.

**Open questions**

- No quantified error rates or formal thresholds for timing primitives (open question, open question, in On-chip telemetry from timing, memory and performance counters; https://trustbutveri.fyi/mechanisms/on-chip-telemetry/evidence/flaws/5/) [1]. Monfared et al. state that false-positive and false-negative rates are not quantified and leave hardware-specific formal thresholds to future work.

**Not yet demonstrated**

- Memory wiping and proofs of secure erasure: Proposed (legacy code R1), assessed for showing that no data from earlier work persists in memory the wipe reaches


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open failure or a dependency. Pointers, not recommendations: each brings its own readiness level and findings, and none is claimed to close a failure.

- **Bandwidth limits and compartmentalization** (Research demonstration (legacy code R2), assessed for monitoring inter-node traffic with operator-run software on four GPUs)
  - Bears on the open significant failure "Outside help during challenges" in Memory wiping and proofs of secure erasure. Removing or capping links between groups of accelerators limits remote memory access during a challenge.
- **Timed challenge-response and memory-occupation challenges** (Research demonstration (legacy code R2), assessed for detecting whether a GPU is doing other work)
  - Bears on the open significant failure "Outside help during challenges" in Memory wiping and proofs of secure erasure. Timed challenges bound how far away a helper can be by how quickly it must answer.
  - Memory wiping and proofs of secure erasure waits on it: Timed challenges must exclude remote memory and other helpers.
- **Hardware-enabled guarantees (flexHEG) and guarantee processors** (Proposed (legacy code R1), assessed for checking and enforcing training-compute limits on chips, against adversaries up to states)
  - On-chip telemetry from timing, memory and performance counters waits on it: Shipping accelerators need a tamper-resistant, authenticated telemetry path.
- **TEE remote attestation for AI workloads** (Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware)
  - On-chip telemetry from timing, memory and performance counters depends on it.


## Dependencies

**Missing prerequisites**

- TEE remote attestation for AI workloads (Operational use (legacy code R3), assessed for showing which software ran to a party that distrusts the operator holding the hardware), needed by On-chip telemetry from timing, memory and performance counters
- Timed challenge-response and memory-occupation challenges (Research demonstration (legacy code R2), assessed for detecting whether a GPU is doing other work), needed by Memory wiping and proofs of secure erasure

**Blockers**

- On-chip telemetry from timing, memory and performance counters: Shipping accelerators need a tamper-resistant, authenticated telemetry path. (hardware trust; waits on Hardware-enabled guarantees (flexHEG) and guarantee processors) [2][3]
- On-chip telemetry from timing, memory and performance counters: NVIDIA's full confidential-computing mode disables the hardware performance counters its profiling tools use, so telemetry that needs them conflicts with it. (privacy & leakage) [4][5]
- On-chip telemetry from timing, memory and performance counters: Continuous challenge puzzles cost power and throughput on production workloads. (performance & compatibility) [1]
- On-chip telemetry from timing, memory and performance counters: Evaluation has not gone beyond single nodes, framework-level evasion and one vendor's hardware. (adversarial validation) [3]
- Memory wiping and proofs of secure erasure: Wipes take time: tens of minutes for a pod's volatile memory and hours for SSDs, displacing work. (performance & compatibility) [9][10][11]
- Memory wiping and proofs of secure erasure: Timed challenges must exclude remote memory and other helpers. (coverage & hidden compute; waits on Timed challenge-response and memory-occupation challenges) [8][9]
- Memory wiping and proofs of secure erasure: All memory stores in a system must be inventoried and wiped at the same time. (coverage & hidden compute) [10]


## What the verifier sees

- Model weights: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by none; not involved in Memory wiping and proofs of secure erasure; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by none; not involved in Memory wiping and proofs of secure erasure; unspecified for none.
- Training data: shown by none; depends on the design for On-chip telemetry from timing, memory and performance counters; hidden by none; not involved in Memory wiping and proofs of secure erasure; unspecified for none.

## Implementations

- On-chip telemetry from timing, memory and performance counters: none on the map
- Memory wiping and proofs of secure erasure: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture)

## Sources

1. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). https://arxiv.org/abs/2602.09369
2. Guaranteeable Memory: An HBM-Based Chiplet for Verifiable AI Workloads, J. Petrie (2025). https://openreview.net/forum?id=uc79kOv0MV
3. Detecting Hidden ML Training With Zero-Overhead Telemetry, R. Rahman & S. Tajdari (2026). https://arxiv.org/abs/2606.19262
4. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). https://techgov.intelligence.org/blog/on-tees-for-privacy-preserving-monitoring-in-ai-governance
5. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). https://docs.nvidia.com/nvidia-secure-ai-with-blackwell-and-hopper-gpus-whitepaper.pdf
6. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
7. Secure Code Update for Embedded Devices via Proofs of Secure Erasure, D. Perito & G. Tsudik (2010). https://link.springer.com/chapter/10.1007/978-3-642-15497-3_39
8. Software-Based Memory Erasure with Relaxed Isolation Requirements, S. Bursuc et al. (2024). https://ieeexplore.ieee.org/document/10664348/
9. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
10. Memory Wipes - Performance Analysis, Amodo Design (2026). https://amododesign.com/notes/2026-07-01-memory-wiping/
11. Improving Disk Wiping Speed for Memory Wipes, Amodo Design (2026). https://amododesign.com/notes/2026-09-14-disk-wiping-speed/
12. Amodo-Design/PoSE-Memory-Wiping (GitHub repository), Amodo Design (2026). https://github.com/Amodo-Design/PoSE-Memory-Wiping
13. Empirical Evaluation of Memory-Erasure Protocols, R. Gil-Pons et al. (2025). https://www.scitepress.org/Papers/2025/135548/135548.pdf