# AI verification proposal

A proposal built with the Proposal Explorer of the AI Verification Tech Map (https://trustbutveri.fyi/), from its records of 2026-10-09. Interactive version: https://trustbutveri.fyi/explorer/?mechanisms=M-0013,M-0019,M-0020&tested=analysis

How to read it: a claim is something one party wants to verify about another's AI hardware or software. A mechanism is a general technique for verifying claims; it is "aimed at" a claim when that is its direct purpose, and "supporting" when it contributes without being aimed at it. A claim is addressed when a mechanism in the proposal is aimed at it and is not excluded by the filters; addressed does not mean verified, so check that mechanism's development status, security evidence and findings. Definitions: https://trustbutveri.fyi/about/methodology/ (roles, properties and findings) and https://trustbutveri.fyi/about/readiness/ (development status).

## Filters

Filters apply to mechanisms only and describe the setting the proposal is for.

- **Attack testing: Published analysis.** Keeps mechanisms whose strongest published attack testing is at least this. The strongest published attempt to break the mechanism for its verification use: a security analysis, red-teaming by its developers or collaborators, or a red team independent of them.

24 of 25 mechanisms on the map pass these filters.

## Overview

One row per mechanism, read from its record. Open failures: critical / significant / minor. The last three columns are the editors' reading of what the verifier sees. Findings are grouped as known failures, scope limitations and open questions. Only known failures count as failures. Counts are an inventory of published findings, not a risk score.

| Mechanism | Development | Security evidence | Prover | Attack testing | Hardware | Open failures | Weights | Inputs and outputs | Training data |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Network taps and certifiers | Proposed | Published security analysis | Adversarial | Analysis | Retrofit device | 0 / 2 / 0 | depends | depends | depends |
| Chip registries and manufacturing records | Proposed | Published security analysis | Semi-trusted | Analysis | Existing features | 0 / 1 / 0 | not involved | not involved | not involved |
| Remote detection of data centres | Proposed | Published security analysis | Adversarial | Analysis | None | 0 / 0 / 0 | not involved | not involved | not involved |

## Claims

No claims chosen.

## Mechanisms

### Network taps and certifiers

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work. ([Network taps and certifiers](https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/))

- Assessment: mechanism family.
- Development: Proposed (legacy code R1), assessed for committing a complete record of cluster traffic, so declared inference can be checked.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: retrofit device. Prover cooperation: required. Attack testing: analysis. Category: Off-chip devices & sensors.
- What the verifier sees: model weights depends; inputs and outputs depends; training data depends. Only hashes leave the site; records picked for a challenge are opened for replay at a verification facility.

### Chip registries and manufacturing records

Recording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later. ([Chip registries and manufacturing records](https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/))

- Assessment: mechanism family.
- Development: Proposed (legacy code R1), assessed for a checkable record of which chips were made and who declared owning them.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: semi-trusted prover. Hardware: existing features. Prover cooperation: required. Attack testing: analysis. Category: Compute accounting & provenance.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Records chip identities and owners; it does not handle model data.

### Remote detection of data centres

Remote detection locates large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records such as permits. ([Remote detection of data centres](https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/))

- Assessment: mechanism family.
- Development: Proposed (legacy code R1), assessed for finding undeclared data centres above an agreed compute threshold.
- Security evidence: Published security analysis. Independent evaluation: unassessed. Formal proof: unassessed. Deployment assurance: unassessed.
- Claims in this proposal: none of them.
- Threat model: adversarial prover. Hardware: none. Prover cooperation: not required. Attack testing: analysis. Category: Remote & side-channel sensing.
- What the verifier sees: model weights not involved; inputs and outputs not involved; training data not involved. Works from outside the facility; it does not handle model data.


## Properties

**Built for an adversarial prover**

- Network taps and certifiers
- Remote detection of data centres

**No new hardware needed**

- Chip registries and manufacturing records
- Remote detection of data centres

**Failures since mitigated**

- Verifier dictionary attacks on hashes (in Network taps and certifiers) [1]


## Attack testing

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

**Testing history**

- Network taps and certifiers: Analysis
- Chip registries and manufacturing records: Analysis
- Remote detection of data centres: Analysis


## Limits

**Open significant failures**

- Output nondeterminism leaves covert capacity (known failure, theoretical argument, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/1/) [1][9]. Hashing cannot remove information hidden in the outputs themselves. The Secure Gateway Device paper estimates that about 0.1 bit per token remains even with seed-synchronized replay checks. For a 200k-GPU inference cluster at full load (2,000 tokens per GPU per second), that is about 40 Mbit/s of covert egress, enough to move a 1 TB model in under three days. The paper names this the core remaining challenge and points to deterministic replay or active scrubbing of hardware-induced entropy. An independent study found that an adversary who chooses the prompts roughly doubles the bits leaked per token under Gumbel-based inference verification; see Bounding unexplained information in outputs.

  Related mechanism: Deterministic and bit-exact inference (R3, not in the proposal). Deterministic replay is one of the two remedies the flaw's source names.

  Related mechanism: Bounding unexplained information in outputs (R2, not in the proposal). Bounds the hidden information outputs can carry by measuring what the declared computation fails to predict.
- Residual side channels in simple passive setups (known failure, theoretical argument, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/4/) [5]. Amodo's analysis of its own tapped prototype lists unvalidated header fields, timing of permitted traffic and variation in response formatting as residual channels, and concludes that the passive tap must be replaced by an active one.
- Documents and serial numbers can be forged (known failure, theoretical argument, in Chip registries and manufacturing records; https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/evidence/flaws/2/) [12]. Avellar and Grunewald note that export documents can be forged, that companies can hide information behind obscure corporate structures, and that it may be possible to forge serial numbers on chips and racks. They recommend cryptographic attestation of a powered-on chip as an extra check.

**Scope limitations**

- Some links cannot be passively tapped (scope limitation, open question, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/2/) [2][10]. Cankaya notes that copper-connected scale-up domains (for example NVL72 racks and TPU v7 cubes) are much harder to tap than fibre, and that optical budgets make passive taps impractical on 400GBASE-SR8 multimode links. Amodo found no taps advertised for 53 GBaud links as of May 2026.
- Encrypted fabrics hide plaintext from both parties (scope limitation, open question, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/3/) [2]. Cankaya notes that with TEE-protected sessions whose keys are ephemeral and managed inside the TEE, neither the operator nor the manufacturer can recover session keys after the session, so tapped traffic could not be opened for recomputation. For other encrypted fabrics, the operator can retain keys.
- Completeness rests on physical monitoring left out of scope (scope limitation, open question, in Network taps and certifiers; https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/evidence/flaws/5/) [1]. The Secure Gateway Device paper assumes the facility is physically monitored, and states that the whole architecture depends on the device being the only communication channel. It names radio emanation, power-line signalling and thermal channels as covert channels beyond that scope.

  Related mechanism: Side-channel suppression for isolated facilities (R1, not in the proposal). Addresses the radio, power-line and thermal channels that network-level designs leave out.
- Records cover only chips that were recorded (scope limitation, theoretical argument, in Chip registries and manufacturing records; https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/evidence/flaws/1/) [13][15]. A registry or commitment accounts only for chips entered into it. Cankaya asks how a verifier would know it had found all chips, or how much "dark compute" remains, and notes that a fraudulent original record would mean unregistered chips had been made in advance. Halstead and Larsen propose reconstructing earlier production by auditing upstream suppliers.

  Related mechanism: Remote detection of data centres (R1, in the proposal). Looks for large data centres that were never declared, which a registry cannot show.
- Insiders could alter records before they are fixed (scope limitation, theoretical argument, in Chip registries and manufacturing records; https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/evidence/flaws/3/) [13]. Cankaya argues that insiders who can photograph process secrets could also tamper with production records. A commitment makes changes after publication detectable, but it cannot show that the records were accurate when committed.
- Facilities can be disguised or hidden (scope limitation, theoretical argument, in Remote detection of data centres; https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/evidence/flaws/1/) [15]. Halstead and Larsen discuss two ways to hide a facility. One is to disguise it as a legitimate industrial site. The other is to build it underground, with cooling that avoids visible heat plumes. They note that the underground option requires bespoke engineering.
- Small sites may not be detectable (scope limitation, theoretical argument, in Remote detection of data centres; https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/evidence/flaws/2/) [15][16]. Halstead and Larsen conclude that a sufficiently small covert project could not be ruled out with confidence. In their estimates, the chance of detection is lower for smaller sites. Krawec notes that small data centres in existing buildings may lack the distinctive features of large facilities.

  Related mechanism: Chip registries and manufacturing records (R1, in the proposal). Accounts for chips from the fab onwards, which does not depend on a site being visible.

**Open questions**

- Search for unknown sites is undemonstrated (open question, open question, in Remote detection of data centres; https://trustbutveri.fyi/mechanisms/remote-detection-of-data-centres/evidence/flaws/3/) [16]. Krawec reports that telling data centres apart from other industrial facilities systematically is difficult. Automating detection would need large amounts of training imagery and a purpose-trained model. In Krawec's words, automated data-centre detection "remains primarily conceptual at present".

**Not yet demonstrated**

- Network taps and certifiers: Proposed (legacy code R1), assessed for committing a complete record of cluster traffic, so declared inference can be checked
- Chip registries and manufacturing records: Proposed (legacy code R1), assessed for a checkable record of which chips were made and who declared owning them
- Remote detection of data centres: Proposed (legacy code R1), assessed for finding undeclared data centres above an agreed compute threshold


## Possible additions

Mechanisms on the map, not in the proposal, that the records connect to an unaddressed or partly addressed claim, an open failure or a dependency. Pointers, not recommendations: each brings its own readiness level and findings, and none is claimed to close a failure.

- **Deterministic and bit-exact inference** (Operational use (legacy code R3), assessed for reproducing open-model inference from receipts in Gensyn's information-market service)
  - Bears on the open significant failure "Output nondeterminism leaves covert capacity" in Network taps and certifiers. Deterministic replay is one of the two remedies the flaw's source names.
  - Network taps and certifiers waits on it: Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove.
- **Bounding unexplained information in outputs** (Research demonstration (legacy code R2), assessed for bounding how much hidden information can leave in checked inference outputs)
  - Bears on the open significant failure "Output nondeterminism leaves covert capacity" in Network taps and certifiers. Bounds the hidden information outputs can carry by measuring what the declared computation fails to predict.
- **Tamper evidence for verifier devices** (Research demonstration (legacy code R2), assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence)
  - Network taps and certifiers waits on it: Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them.
- **Side-channel suppression for isolated facilities** (Proposed (legacy code R1), assessed for bounding physical covert channels out of a verified enclosure)
  - Network taps and certifiers waits on it: Radio, power-line and thermal channels are not addressed by network-level designs.
- **Sampled inference recomputation** (Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision)
  - Network taps and certifiers depends on it.


## Dependencies

**Missing prerequisites**

- Sampled inference recomputation (Operational use (legacy code R3), assessed for checking untrusted workers' activations against the declared model, prompt and precision), needed by Network taps and certifiers
- Deterministic and bit-exact inference (Operational use (legacy code R3), assessed for reproducing open-model inference from receipts in Gensyn's information-market service), needed by Network taps and certifiers
- Tamper evidence for verifier devices (Research demonstration (legacy code R2), assessed for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence), needed by Network taps and certifiers
- Side-channel suppression for isolated facilities (Proposed (legacy code R1), assessed for bounding physical covert channels out of a verified enclosure), needed by Network taps and certifiers

**Blockers**

- Network taps and certifiers: No complete verification tap has been demonstrated at production frontend link rates, and on the tested CPU no hash algorithm reached line rate with minimum-size frames. (performance & compatibility) [10][19]
- Network taps and certifiers: Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove. (evidence binding; waits on Deterministic and bit-exact inference) [1]
- Network taps and certifiers: Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them. (hardware trust; waits on Tamper evidence for verifier devices) [1][3]
- Network taps and certifiers: Radio, power-line and thermal channels are not addressed by network-level designs. (coverage & hidden compute; waits on Side-channel suppression for isolated facilities) [1]
- Network taps and certifiers: Red-teaming by specialists is called for but has not been reported. (adversarial validation) [1]
- Chip registries and manufacturing records: No implementation of an AI chip registry has been publicly reported, and covering re-exports would need cooperation from re-exporters and foreign governments that may not be feasible everywhere. (access & governance) [11][12]
- Chip registries and manufacturing records: Linking records to physical chips needs hard-to-spoof unique IDs and inspections. (hardware trust) [11][12][13]
- Chip registries and manufacturing records: Chips produced before a registry starts must be reconstructed from supplier records. (coverage & hidden compute) [13][15]
- Remote detection of data centres: Wide-area, automated detection of data centres is not yet practical and needs large training datasets. (coverage & hidden compute) [16]
- Remote detection of data centres: No measured detection or false-alarm rates for finding undeclared facilities have been published. (adversarial validation) [15][16]
- Remote detection of data centres: Recent high-resolution imagery is costly, is limited by weather and needs trained analysts. (access & governance) [16]


## What the verifier sees

- Model weights: shown by none; depends on the design for Network taps and certifiers; hidden by none; not involved in Chip registries and manufacturing records and Remote detection of data centres; unspecified for none.
- Inputs and outputs: shown by none; depends on the design for Network taps and certifiers; hidden by none; not involved in Chip registries and manufacturing records and Remote detection of data centres; unspecified for none.
- Training data: shown by none; depends on the design for Network taps and certifiers; hidden by none; not involved in Chip registries and manufacturing records and Remote detection of data centres; unspecified for none.

## Implementations

- Network taps and certifiers: [AI 2040 inference-only verification stack](https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/) (R1, proposed architecture); [Low-trust AI compute verification system overview](https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/) (R1, proposed architecture); [SASH confidential network logger](https://trustbutveri.fyi/implementations/sash-confidential-network-logger/) (R1, research prototype)
- Chip registries and manufacturing records: none on the map
- Remote detection of data centres: none on the map

## Sources

1. Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors, N. Cankaya et al. (2026). https://arxiv.org/abs/2606.10724
2. The Fundamentals and Feasibility of Secure Network Taps for Verifying AI Datacenter Use, N. Cankaya (2026). https://nacicankaya.substack.com/p/research-note-the-fundamentals-and
3. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). https://intelligence.org/wp-content/uploads/2026/06/A-system-overview-for-near-term-low-trust-AI-compute-verification.pdf
4. Verification Plan, R. Dean (2026). https://ai-2040.com/supplements/verification-plan
5. Fitting a Network TAP to our Inference Verification Prototype, Amodo Design (2026). https://amododesign.com/notes/2026-09-15-network-tap-inference-verification/
6. Amodo-Design/Inference-Recomputation-Prototype (GitHub repository), Amodo Design (2026). https://github.com/Amodo-Design/Inference-Recomputation-Prototype
7. inference-verification: Inference Verification Prototype, Singapore AI Safety Hub (SASH) (2026). https://github.com/sg-ai-safety-hub/inference-verification
8. Internationalising AI Verification, Singapore AI Safety Hub (SASH) (2026). https://www.aisafety.sg/research/internationalising-ai-verification
9. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). https://arxiv.org/abs/2608.23375
10. Network Tapping for AI Verification: A Technical Assessment, Amodo Design (2026). https://amododesign.com/notes/2026-05-03-network-tapping/
11. Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment, M. Baker et al. (2025). https://www.rand.org/pubs/working_papers/WRA4077-1.html
12. Near-Term Verification Methods for AI Chip Exports, B. Avellar & E. Grunewald (2026). https://www.iaps.ai/research/near-term-verification-methods-for-ai-chip-exports
13. TSMC most definitely has a golden record of all AI chips it made, N. Cankaya (2025). https://nacicankaya.substack.com/p/tsmc-most-definitely-has-a-golden
14. Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification, S. Ansari (2026). https://arxiv.org/abs/2604.04712
15. Covert AI Projects, B. Halstead & T. Larsen (2026). https://ai-2040.com/supplements/covert-ai-projects
16. Tracking Hyperscale AI Data Center Growth with Satellite Imagery, C. Krawec (2026). https://fas.org/publication/tracking-hyperscale/
17. Introducing the Frontier Data Centers Hub, Epoch AI (2025). https://epoch.ai/latest/introducing-the-frontier-data-centers-hub
18. AI Data Centers Documentation – Methodology, Epoch AI (2026). https://epoch.ai/data/data-centers-documentation/methodology
19. Network Traffic Hashing, Amodo Design (2026). https://amododesign.com/notes/2026-07-03-network-traffic-hashing/