Proposal Explorer

Add claims to see which ones the mechanisms address.

Built for an adversarial prover

Timed challenge-response and memory-occupation challenges

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Side-channel suppression for isolated facilities, RAND secure inference data center (SIDC) design: Analysis
• Timed challenge-response and memory-occupation challenges, Low-trust AI compute verification system overview: Analysis

Family findings

• Side-channel suppression for isolated facilities

  Context for RAND secure inference data center (SIDC) design. These findings concern the family or other implementations; applicability must be checked against their stated scope.

  • Supply-chain implants may evade inspection in Side-channel suppression for isolated facilities

    Cankaya identifies malicious hardware embedded deep in purchased components as a residual risk that visual inspection and disassembly may not catch. He notes that radiographic examination under high-security standards could mitigate it. ²

    Theoretical argument · Significant · Open. On the record

  • Openings for airflow, power and optics weaken shielding in Side-channel suppression for isolated facilities

    Cankaya notes that keeping attenuation high while passing high-power airflow, cabling and optical links adds complexity beyond existing shielded-enclosure specifications. ²

    Theoretical argument · Significant · Open. On the record

  • Inspection assumptions may not hold in Side-channel suppression for isolated facilities

    The design's statistical argument assumes that visual or disassembly inspection catches every flaw that is present in a sampled unit. Cankaya is unsure whether destructive teardowns are defence-dominant or offence-dominant. ²

    Open question · Significant · Open. On the record

• Timed challenge-response and memory-occupation challenges

  Context for Low-trust AI compute verification system overview. These findings concern the family or other implementations; applicability must be checked against their stated scope.

  • Timing-based software attestation has been broken in practice in Timed challenge-response and memory-occupation challenges

    Castelluccia et al. implemented two generic attacks, one based on a return-oriented rootkit and one on code compression, together with specific attacks on SWATT and ICE-based schemes, on commodity sensor nodes. They conclude that secure time-based attestation is "very difficult, if not impossible, to design correctly". The attacks target embedded schemes, not AI accelerators. ^{5 6}

    Response: Perrig and van Doorn, two of the designers of SWATT and ICE, replied in August 2010. They argue that the rootkit attack defeats a naive implementation, not a property the schemes claim, and that the SWATT attack was run on a re-implementation on a chip with eight times the program memory, where SWATT's own chip is almost always full of code. They accept that the attack on ICE works.

    Demonstrated attack · Significant · Disputed. On the record

  • Remote memory narrows the timing margin in Timed challenge-response and memory-occupation challenges

    Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges. ³

    Theoretical argument · Significant · Open. On the record

    Related mechanism R2 Bandwidth limits and compartmentalization: Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced. A pointer, not evidence that this flaw is mitigated. Add

  • Error rates not quantified in Timed challenge-response and memory-occupation challenges

    Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified. ⁷

    Open question · Minor · Open. On the record

Open significant flaws

3 flaws in 2 mechanisms

• Everything rests on the trusted setup in RAND secure inference data center (SIDC) design

  Reference measurements for model weights and reference data are established in a trusted setup phase. The report states that the system cannot detect compromise that happened before ingestion if the trusted setup itself is compromised. ¹

  Theoretical argument · Significant · Open. On the record

• Mismatches cannot be attributed to cheating or error in Low-trust AI compute verification system overview

  A failed hash or replay does not show whether it came from an evasion attempt, a random bit flip or an evaluation error. The author notes that if detected anomalies can plausibly be waved off as malfunctions, deterrence becomes less effective, so the parties need an agreed escalation procedure that ends in attribution. ³

  Theoretical argument · Significant · Open. On the record

• Inspector agents may be manipulable in Low-trust AI compute verification system overview

  Automated compliance screening with LLM-based inspector agents must resist prompt-injection attacks. Adversarially trained systems might hide malicious actions with steganography, which makes backdoor detection an open problem. ³

  Open question · Significant · Open. On the record

Open minor flaws

2 mechanisms with minor findings

• Security weakens over long operation in RAND secure inference data center (SIDC) design

  The authors claim that the facility can withstand attacks at the OC5 level for a five-year operational period. They expect its ability to withstand long OC5 campaigns to become less robust the longer the facility remains in operation. ¹

  Theoretical argument · Minor · Open. On the record

• Deliberate faults leak a bit each in Low-trust AI compute verification system overview

  A malicious device can leak one bit by deliberately outputting a wrong result, which blocks a disclosure when the cross-comparison fails. The design therefore needs a pre-agreed budget of tolerated faults. ³

  Theoretical argument · Minor · Open. On the record

Not yet demonstrated

R1 Side-channel suppression for isolated facilities and R1 Timed challenge-response and memory-occupation challenges

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R3 Deterministic and bit-exact inference Add
  • Timed challenge-response and memory-occupation challenges waits on it. Exact replay needs complete hardware and software metadata, and the tolerable slowdown from emulation is an open question.
• R2 Tamper evidence for verifier devices Add
  • Timed challenge-response and memory-occupation challenges waits on it. Tamper-evident, rapidly mass-manufacturable and retrofittable enclosures for side-channel defence are an open research question, and physical security against covert communication in every monitored data centre is challenging.
• R1 Network taps and certifiers Add
  • Timed challenge-response and memory-occupation challenges waits on it. Empirical feasibility of passive optical splitting at 53–112 GBaud under realistic conditions is an open question.
• R3 Model identity attestation Add
  • Side-channel suppression for isolated facilities depends on it.

Missing prerequisites

• R3 Model identity attestation needed by Side-channel suppression for isolated facilities Add
• R1 Network taps and certifiers needed by Timed challenge-response and memory-occupation challenges Add
• R3 Deterministic and bit-exact inference needed by Timed challenge-response and memory-occupation challenges Add

Blockers

10 blockers recorded

• Side-channel suppression for isolated facilities
  • No prototype exists; RAND recommends prototyping key security features and integration now. Adversarial validation ¹
  • The report describes internal integrity checks, audit logging and accreditation, but no way for a party outside the operator to verify the facility's properties. Access & governance ¹
  • Human review of every prompt and response makes each request take three to five minutes, with the review steps as the rate-limiting factor. Performance & compatibility ¹
  • Detailed design information is withheld from the public report and is to be evaluated privately with stakeholders, which limits independent public scrutiny. Access & governance ¹
• Timed challenge-response and memory-occupation challenges
  • Empirical feasibility of passive optical splitting at 53–112 GBaud under realistic conditions is an open question. Performance & compatibility. Waits on Network taps and certifiers ³
  • Exact replay needs complete hardware and software metadata, and the tolerable slowdown from emulation is an open question. Performance & compatibility. Waits on Deterministic and bit-exact inference ³
  • Tamper-evident, rapidly mass-manufacturable and retrofittable enclosures for side-channel defence are an open research question, and physical security against covert communication in every monitored data centre is challenging. Hardware trust. Waits on Tamper evidence for verifier devices ³
  • A mass-manufacturable, good-enough side-channel defence, particularly power-line filtering, has not been constructed or red-teamed. Coverage & hidden compute. Waits on Side-channel suppression for isolated facilities ³
  • Distinguishing one server's DRAM contents from another's by challenge-response timing, and a general challenge-response protocol for diverse data types, are open. Coverage & hidden compute. Waits on Timed challenge-response and memory-occupation challenges ³
  • The threat model is under-developed and needs input from cybersecurity and AI threat-modelling experts. Adversarial validation ³

From the family or selected implementation's record. ?

Model weights

Unspecified for Side-channel suppression for isolated facilities and Timed challenge-response and memory-occupation challenges. Check the implementation record.

Inputs and outputs

Unspecified for Side-channel suppression for isolated facilities and Timed challenge-response and memory-occupation challenges. Check the implementation record.

Training data

Unspecified for Side-channel suppression for isolated facilities and Timed challenge-response and memory-occupation challenges. Check the implementation record.

Side-channel suppression for isolated facilities

• R1 AI 2040 inference-only verification stack Proposed architecture, AI Futures Project
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R1 RAND secure inference data center (SIDC) design Proposed architecture, RAND

Timed challenge-response and memory-occupation challenges

• R1 Data-centre memory challenging Proposed architecture, Machine Intelligence Research Institute
• R2 GPU contention probes Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 SAGE Research prototype
• R2 VRAM-residency challenge Research prototype

1. Highly Secure Inference Data Centers: A Vertically Integrated Strategy for Security Engineering, S. F. Comer et al. (2026). Original
2. Suppressing Side Channels in an Untrusted Data Center via Retrofitted Defenses, N. Cankaya (2026). Original
3. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
4. Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors, N. Cankaya et al. (2026). Original
5. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). Original
6. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). Original
7. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). Original