Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Tamper evidence for verifier devices

No new hardware needed

Hardware-attested weight binding

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

• Tamper evidence for verifier devices: Analysis
• Hardware-attested weight binding, Attestable Audits: Analysis

Family findings

• Hardware-attested weight binding

  Context for Attestable Audits. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there.

  • Underlying attestation can be forged or relayed in Hardware-attested weight binding

    Critical for weight binding against an operator with physical access to affected hardware, or with control of the hypervisor on an AMD SEV-SNP platform without AMD's fixes. PAL*M excludes physical attacks, and Tinfoil acknowledges this boundary.

    The enclave route inherits the platform-specific TEE attestation failures. Intel TDX forgery and H100 relay were demonstrated with physical access and host control. Battering RAM defeated AMD SEV-SNP attestation on DDR4 servers; RMPocalypse did so from malicious host software on platforms without AMD's fixes. These demonstrate failures of the trust roots, not of each model-commitment protocol. ^{13 14 15 16 17 18}

    Response: The TEE.fail authors report that physical interposer attacks are outside Intel's and AMD's threat models. AMD reports fixes for RMPocalypse.

    Known failure · Demonstrated attack · Critical · Open · Inherited finding. On the record · Related finding in TEE remote attestation for AI workloads

    Related mechanism Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this failure is mitigated. Add

  • Launch-state attestation does not by itself cover weights loaded later in Hardware-attested weight binding

    Attestation measures launch state, and weights are read from disk after boot. A signature checked at load time does not stop a malicious hypervisor from altering the disk afterwards. Tinfoil reports mitigating this with dm-verity checks on every read. Unmeasured runtime configuration remains a general risk. ^{19 20}

    Known failure · Theoretical argument · Significant · Mitigated. On the record

  • For private models, a user can confirm consistency but not content in Hardware-attested weight binding

    When weights are not published, users can check that the same root hash is served each time, but not what the model is. Pairing the hash with an attested evaluation, as in Attestable Audits, is one proposed remedy. ^{11 19}

    Scope limitation · Open question. On the record

Open significant failures

2 failures in 1 mechanism

• Seals are often defeated with simple methods in Tamper evidence for verifier devices

  Published defeats of general security seals. They warn about proposed verifier-device seals, but do not demonstrate defeat of an AI verification enclosure or sensor.

  In 1996 a Los Alamos vulnerability assessment defeated all 94 security seals it examined, with 132 defeats in total, using rapid, inexpensive, low-tech methods. It found that seal cost did not predict security. In 2001 Johnston reported that high-tech seals are often easier to defeat than low-tech ones. ^{8 9}

  Known failure · Demonstrated attack · Significant · Open · Mechanism-class evidence. On the record

• Attack classes outside published models in Tamper evidence for verifier devices

  The radio compensation result is emulated using measured channel data under a known-reference attacker model. It is not a physical bypass demonstration against an AI verifier enclosure.

  The authors of the batteryless cover say they cannot assess chemical-solvent attacks, which exceed their expertise, and deem cover removal impractical. Anti-Tamper Radio's reference can drift as the environment or measurement system ages; the authors suggest gradually renewing the reference. A 2025 follow-up by some of the same authors shows, by emulation on measured channel data, that an attacker who knows the reference channel and the needle's effect on it could inject a signal that cancels the change caused by a needle insertion. It proposes a reconfigurable intelligent surface that randomizes the channel as a countermeasure. ^{1 2 10}

  Known failure · Open question · Significant · Open · Mechanism-class evidence. On the record

Scope limitations

• Security depends on inspection protocols in Tamper evidence for verifier devices

  An inspection and protocol requirement drawn from safeguards and enclosure studies, not a reported break of a deployed AI verifier.

  Johnston argues that a seal is no better than the protocols for using it, and that inspectors are usually given little useful information on how to detect tampering. The Sandia survey notes that larger enclosures are hard to inspect fully and that sensor data must be authenticated. ^{6 9}

  Scope limitation · Theoretical argument · Mechanism-class evidence. On the record

• Relies on the TEE vendor and inherits TEE attacks in Attestable Audits

  The prototype trusts AWS Nitro, not the Intel TDX or AMD SEV-SNP attestation roots targeted by the cited confidential-VM studies. Those studies are class context, not a demonstrated attack on this Nitro prototype.

  The design depends on trusting the TEE vendor, AWS in the prototype. The authors cite memory-aliasing, ciphertext side-channel and malicious-interrupt attacks on confidential VMs (BadRAM, CIPHERLEAKS, Heckler). Their answer is to revoke vulnerable base images once such attacks are discovered. ¹¹

  Response: The authors propose revoking vulnerable base images; they do not report a red-team evaluation of the prototype.

  Scope limitation · Theoretical argument · Inherited finding. On the record · Related finding in TEE remote attestation for AI workloads

• CPU-only enclaves force small, quantized models and high cost in Attestable Audits

  Memory limits required 4-bit quantization, and the quantized model scored 51.4% on zero-shot MMLU. CPU inference cost 21.7 times as much per token as GPU inference, and the enclave roughly doubled the CPU cost. The authors wrote that H100 confidential computing had no multi-GPU support. NVIDIA's white paper of August 2025 describes a protected-PCIe mode that passes all eight GPUs of a Hopper HGX node to one confidential VM, with NVLink traffic unencrypted. ^{11 12}

  Scope limitation · Open question. On the record

Open questions

• Prompt-based model exfiltration is a residual gap in Attestable Audits

  The authors state that "prompt-based model exfiltration during the user interaction step remains a residual gap". ¹¹

  Open question · Open question. On the record

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• Operational use TEE remote attestation for AI workloads Add
  • Hardware-attested weight binding waits on it. The prototype needs porting to GPU confidential computing to handle larger models; the authors expect an overhead as small as 5 times there.

Missing prerequisites

• Operational use TEE remote attestation for AI workloads needed by Hardware-attested weight binding Add

Blockers

6 blockers recorded

• Tamper evidence for verifier devices
  • No tamper-evident enclosure has been designed for AI verifier hardware at retrofit scale. Hardware trust ⁷
  • Battery-backed designs add bulk, limit operating temperature (+10 °C to +35 °C for the IBM 4765) and complicate transport. Performance & compatibility ²
  • Active monitoring needs power, and visual inspection of large enclosures faces access limits. Access & governance ⁶
  • No evaluation has been published in the AI verification setting. Adversarial validation ⁷
• Hardware-attested weight binding
  • The prototype needs porting to GPU confidential computing to handle larger models; the authors expect an overhead as small as 5 times there. Performance & compatibility. Waits on TEE remote attestation for AI workloads ¹¹
  • As of September 2026 no code has been released for the prototype. Adversarial validation ¹¹

From the family or selected implementation's record. ?

Model weights

Not involved: Tamper evidence for verifier devices.

Unspecified for Hardware-attested weight binding. Check the implementation record.

Inputs and outputs

Not involved: Tamper evidence for verifier devices.

Unspecified for Hardware-attested weight binding. Check the implementation record.

Training data

Not involved: Tamper evidence for verifier devices.

Unspecified for Hardware-attested weight binding. Check the implementation record.

Tamper evidence for verifier devices

• Proposed AI 2040 inference-only verification stack Proposed architecture, AI Futures Project

Hardware-attested weight binding

• Research demo Attestable Audits Research prototype, University of Cambridge
• Research demo PAL*M Research prototype, University of Waterloo
• Operational use Tinfoil model identity (Modelwrap) Product, Tinfoil

1. Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems, P. Staat et al. (2022). Original
2. Secure Physical Enclosures from Covers with Tamper-Resistance, V. Immler et al. (2019). Original
3. ImpedanceVerif: On-Chip Impedance Sensing for System-Level Tampering Detection, T. Mosavirik et al. (2023). Original
4. IBM 4765 Cryptographic Coprocessor Security Module: Security Policy, IBM Corporation (2012). Original
5. PHYSEC SEAL: Change detection for maximum safety, PHYSEC GmbH (2026). Original
6. Tamper-Indicating Enclosures, A Current Survey, H. A. Smartt & Z. N. Gastelum (2015). Original
7. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
8. Physical Security and Tamper-Indicating Devices, R. G. Johnston & A. R. E. Garcia (1996). Original
9. Tamper Detection for Safeguards and Treaty Monitoring: Fantasies, Realities, and Potentials, R. G. Johnston (2001). Original
10. Anti-Tamper Radio Meets Reconfigurable Intelligent Surface for System-Level Tamper Detection, M. S. Tabar et al. (2025). Original
11. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). Original
12. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). Original
13. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). Original
14. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). Original
15. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). Original
16. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). Original
17. A primer on secure enclaves, Tinfoil (2026). Original
18. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). Original
19. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). Original
20. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). Original