Proposal Explorer

Add claims to see which ones the mechanisms address.

Operational use

• Operational use Hardware-attested weight binding for hardware-attested weight binding showing users that a service runs its committed weights
• Operational use Proofs of useful work for capacity accounting for checking matrix-multiplication work proofs for blockchain consensus

Built for an adversarial prover

Proofs of useful work for capacity accounting

No new hardware needed

Hardware-attested weight binding and Proofs of useful work for capacity accounting

Failures since mitigated

• Launch-state attestation does not by itself cover weights loaded later in Hardware-attested weight binding ^{1 11}

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

• Hardware-attested weight binding: Independent red-team
• Proofs of useful work for capacity accounting, Pearl proof-of-useful-work blockchain: Analysis

Open critical failures

• Underlying attestation can be forged or relayed in Hardware-attested weight binding

  Critical for weight binding against an operator with physical access to affected hardware, or with control of the hypervisor on an AMD SEV-SNP platform without AMD's fixes. PAL*M excludes physical attacks, and Tinfoil acknowledges this boundary.

  The enclave route inherits the platform-specific TEE attestation failures. Intel TDX forgery and H100 relay were demonstrated with physical access and host control. Battering RAM defeated AMD SEV-SNP attestation on DDR4 servers; RMPocalypse did so from malicious host software on platforms without AMD's fixes. These demonstrate failures of the trust roots, not of each model-commitment protocol. ^{2 3 7 8 9 10}

  Response: The TEE.fail authors report that physical interposer attacks are outside Intel's and AMD's threat models. AMD reports fixes for RMPocalypse.

  Known failure · Demonstrated attack · Critical · Open · Inherited finding. On the record · Related finding in TEE remote attestation for AI workloads

  Related mechanism Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this failure is mitigated. Add

Family findings

• Proofs of useful work for capacity accounting

  Context for Pearl proof-of-useful-work blockchain. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there.

  • Proves that work was done, not that no capacity remains in Proofs of useful work for capacity accounting

    Proof-of-work accounting bounds unmonitored compute only relative to an estimate of what the actor has. Attestable states that the verifier "needs a credible estimate of the compute available" to the actor, and that a proof "cannot discover a datacenter that was never declared". ¹⁸

    Scope limitation · Theoretical argument. On the record

    Related mechanism Proposed Chip registries and manufacturing records: A registry of chips is one basis for the estimate of available compute that the flaw's source says the verifier needs. A pointer, not evidence that this failure is mitigated. Add

    Related mechanism Proposed Remote detection of data centres: Looks for data centres that were never declared, which a proof cannot discover. A pointer, not evidence that this failure is mitigated. Add

  • Security rests on new hardness assumptions in Proofs of useful work for capacity accounting

    Komargodski and Weinstein base security on hardness assumptions about batches of low-rank random linear equations, and list PoUW "from more standard or well-studied assumptions" as an open problem. Pearl's floating-point variant introduces a further "quantized-subspace hardness" assumption. ^{14 16}

    Open question · Open question. On the record

  • Known shortcuts let a miner claim somewhat more work than it did in Proofs of useful work for capacity accounting

    Pearl's specification lists known mining speedups: crafted inputs, precision shortcuts, seed grinding, work reuse, and faster kernels or hardware. A policy check caps the summands a miner may skip at one-sixteenth of those in a tile. For capacity bounding, any gap between work proven and work possible leaves spare capacity. ¹⁴

    Known failure · Theoretical argument · Significant · Open. On the record

Scope limitations

• For private models, a user can confirm consistency but not content in Hardware-attested weight binding

  When weights are not published, users can check that the same root hash is served each time, but not what the model is. Pairing the hash with an attested evaluation, as in Attestable Audits, is one proposed remedy. ^{1 12}

  Scope limitation · Open question. On the record

• Verification does not check that mined matrices come from AI workloads in Pearl proof-of-useful-work blockchain

  Miners choose their own matrices. Basu reports that Pearl's verification "does not check whether the matrices originate from an AI model", that random matrices pass it, and that Pearl's reference mining code generates uniformly random matrices, with vLLM inference as an option. String analysis suggests that the dominant third-party mining software contains no inference code. Basu also finds that a naive fixed-threshold check of matrix kurtosis is defeated, at negligible cost, by sampling clipped Gaussian matrices. Basu calls the gap "a design property" rather than a vulnerability. It does not affect the claim that work was performed, but it means the "useful" part of the work is not verified. ^{16 17}

  Scope limitation · Theoretical argument. On the record

Open questions

• Security rests on a new, informal hardness assumption in Pearl proof-of-useful-work blockchain

  The FP8 scheme relies on "Assumption 1 (Informal quantized-subspace hardness)": quantised products of noised matrices are assumed not to be substantially easier than generic ones. The integer construction it extends lists PoUW from more standard assumptions as an open problem. ^{14 16}

  Open question · Open question. On the record

Open minor failures

1 mechanism with minor failures

• Known mining speedups reduce work per proof in Pearl proof-of-useful-work blockchain

  Pearl lists known speedups: crafted inputs, precision shortcuts, seed or commitment grinding, work reuse, and faster kernels or hardware. Its jackpot policy checks limit crafted inputs, and a policy check caps skippable summands at one-sixteenth of those in a tile. Pearl describes faster honest kernels or hardware as "not an attack on the protocol". ¹⁴

  Known failure · Theoretical argument · Minor · Open. On the record

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors Add
  • Bears on the open critical failure “Underlying attestation can be forged or relayed” in Hardware-attested weight binding. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
• Operational use TEE remote attestation for AI workloads Add
  • Hardware-attested weight binding waits on it. Attestation that resists physical attackers, for the enclave variant.
• Operational use Deterministic and bit-exact inference Add
  • Proofs of useful work for capacity accounting depends on it.

Missing prerequisites

• Operational use TEE remote attestation for AI workloads needed by Hardware-attested weight binding Add
• Operational use Deterministic and bit-exact inference needed by Proofs of useful work for capacity accounting Add

Blockers

4 blockers recorded

• Hardware-attested weight binding
  • Attestation that resists physical attackers, for the enclave variant. Hardware trust. Waits on TEE remote attestation for AI workloads ⁷
• Proofs of useful work for capacity accounting
  • Built for consensus rather than capacity bounding; verifying that declared hardware has no spare capacity would also need a credible compute estimate. Capacity bounds ¹⁸
  • Performance figures are provider-reported, and the benchmark reports no baseline of the certified model without mining. Adversarial validation ¹⁵
  • Bit-exact verification depends on reproducing GPU arithmetic deterministically. Performance & compatibility ¹⁴

From the family or selected implementation's record. ?

Model weights

Hidden by Hardware-attested weight binding.

Unspecified for Proofs of useful work for capacity accounting. Check the implementation record.

Inputs and outputs

Unspecified for Hardware-attested weight binding and Proofs of useful work for capacity accounting. Check the implementation record.

Training data

Not involved: Hardware-attested weight binding.

Unspecified for Proofs of useful work for capacity accounting. Check the implementation record.

Hardware-attested weight binding

• Research demo Attestable Audits Research prototype, University of Cambridge
• Research demo PAL*M Research prototype, University of Waterloo
• Operational use Tinfoil model identity (Modelwrap) Product, Tinfoil

Proofs of useful work for capacity accounting

• Operational use Pearl proof-of-useful-work blockchain Open-source project, Pearl Research Labs

1. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). Original
2. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). Original
3. A primer on secure enclaves, Tinfoil (2026). Original
4. Backend infrastructure, Tinfoil (2026). Original
5. How verification works in Tinfoil, Tinfoil (2026). Original
6. modelwrap: Reproducible dm-verity read-only image of Huggingface models, Tinfoil (2026). Original
7. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). Original
8. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). Original
9. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). Original
10. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). Original
11. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). Original
12. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). Original
13. pearl: Monorepo for the Pearl network, Pearl Research Labs (2026). Original
14. Pearl Floating Point Scheme Specification, Pearl Research Team (2026). Original
15. Pearl INT Whitepaper, Pearl Research Labs (2026). Original
16. Proofs of Useful Work from Arbitrary Matrix Multiplication, I. Komargodski & O. Weinstein (2025). Original
17. The Usefulness Gap in Proof-of-Useful-Work: An Empirical Study of Pearl's cuPOW Protocol, A. Basu (2026). Original
18. Pacing AI Requires Proof, Attestable (2026). Original