Proposal Explorer

Add claims to see which ones the mechanisms address.

In production

• R3 Deterministic and bit-exact inference for reproducing open-model inference from receipts in Gensyn's information-market service

Built for an adversarial prover

Side-channel suppression for isolated facilities, Deterministic and bit-exact inference and Timed challenge-response and memory-occupation challenges

No new hardware needed

Deterministic and bit-exact inference and Timed challenge-response and memory-occupation challenges

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Side-channel suppression for isolated facilities, Low-trust AI compute verification system overview: Analysis
• Deterministic and bit-exact inference: Analysis
• Timed challenge-response and memory-occupation challenges: Analysis

Family findings

• Side-channel suppression for isolated facilities

  Context for Low-trust AI compute verification system overview. These findings concern the family or other implementations; applicability must be checked against their stated scope.

  • Supply-chain implants may evade inspection in Side-channel suppression for isolated facilities

    Cankaya identifies malicious hardware embedded deep in purchased components as a residual risk that visual inspection and disassembly may not catch. He notes that radiographic examination under high-security standards could mitigate it. ³

    Theoretical argument · Significant · Open. On the record

  • Openings for airflow, power and optics weaken shielding in Side-channel suppression for isolated facilities

    Cankaya notes that keeping attenuation high while passing high-power airflow, cabling and optical links adds complexity beyond existing shielded-enclosure specifications. ³

    Theoretical argument · Significant · Open. On the record

  • Inspection assumptions may not hold in Side-channel suppression for isolated facilities

    The design's statistical argument assumes that visual or disassembly inspection catches every flaw that is present in a sampled unit. Cankaya is unsure whether destructive teardowns are defence-dominant or offence-dominant. ³

    Open question · Significant · Open. On the record

Open significant flaws

4 flaws in 3 mechanisms

• Mismatches cannot be attributed to cheating or error in Low-trust AI compute verification system overview

  A failed hash or replay does not show whether it came from an evasion attempt, a random bit flip or an evaluation error. The author notes that if detected anomalies can plausibly be waved off as malfunctions, deterrence becomes less effective, so the parties need an agreed escalation procedure that ends in attribution. ¹

  Theoretical argument · Significant · Open. On the record

• Inspector agents may be manipulable in Low-trust AI compute verification system overview

  Automated compliance screening with LLM-based inspector agents must resist prompt-injection attacks. Adversarially trained systems might hide malicious actions with steganography, which makes backdoor detection an open problem. ¹

  Open question · Significant · Open. On the record

• Cross-hardware replay relies on reverse-engineered, closed behaviour in Deterministic and bit-exact inference

  Emulating one GPU's rounding on another requires reverse-engineering tensor-core arithmetic and modelling proprietary kernel choices. Hawkeye covers a subset of NVIDIA architectures and states that attention and other higher-level operations need further reverse engineering. For the bit-exact emulator, a proprietary Hopper kernel family is an open edge case. ^{4 6}

  Open question · Significant · Open. On the record

• Remote memory narrows the timing margin in Timed challenge-response and memory-occupation challenges

  Data-centre remote memory access returns in about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview says verification of memory saturation depends on ruling out remote access by latency or physical disconnection. It adds that pre-staging data is ruled out only by unpredictable, capacity-filling challenges. ¹

  Theoretical argument · Significant · Open. On the record

  Related mechanism R2 Bandwidth limits and compartmentalization: Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced. A pointer, not evidence that this flaw is mitigated. Add

Open minor flaws

3 mechanisms with minor findings

• Deliberate faults leak a bit each in Low-trust AI compute verification system overview

  A malicious device can leak one bit by deliberately outputting a wrong result, which blocks a disclosure when the cross-comparison fails. The design therefore needs a pre-agreed budget of tolerated faults. ¹

  Theoretical argument · Minor · Open. On the record

• Some kernels remain genuinely nondeterministic in Deterministic and bit-exact inference

  The bit-exact work separates kernels that are deterministic but not batch-invariant from truly nondeterministic ones that use atomic functions. Some integer de-quantization kernels use atomic additions and remain nondeterministic, so exact replay needs backends that avoid them. ⁴

  Open question · Minor · Open. On the record

• Error rates not quantified in Timed challenge-response and memory-occupation challenges

  Monfared et al. show separable timing distributions but do not define thresholds or statistical tests, so false-positive and false-negative rates are not quantified. ¹⁵

  Open question · Minor · Open. On the record

Not yet demonstrated

R1 Side-channel suppression for isolated facilities

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R2 Bandwidth limits and compartmentalization Add
  • Bears on the open significant flaw “Remote memory narrows the timing margin” in Timed challenge-response and memory-occupation challenges. Physical disconnection is proposed to exclude remote memory between the separated groups during a challenge. It depends on the isolation boundary being enforced.
  • Timed challenge-response and memory-occupation challenges waits on it. Outside help, such as remote memory, must be excluded during challenges.
• R2 Tamper evidence for verifier devices Add
  • Side-channel suppression for isolated facilities waits on it. Tamper-evident, rapidly mass-manufacturable and retrofittable enclosures for side-channel defence are an open research question, and physical security against covert communication in every monitored data centre is challenging.
• R1 Network taps and certifiers Add
  • Side-channel suppression for isolated facilities waits on it. Empirical feasibility of passive optical splitting at 53–112 GBaud under realistic conditions is an open question.

Missing prerequisites

• R1 Network taps and certifiers needed by Side-channel suppression for isolated facilities Add

Blockers

13 blockers recorded

• Side-channel suppression for isolated facilities
  • Empirical feasibility of passive optical splitting at 53–112 GBaud under realistic conditions is an open question. Performance & compatibility. Waits on Network taps and certifiers ¹
  • Exact replay needs complete hardware and software metadata, and the tolerable slowdown from emulation is an open question. Performance & compatibility. Waits on Deterministic and bit-exact inference ¹
  • Tamper-evident, rapidly mass-manufacturable and retrofittable enclosures for side-channel defence are an open research question, and physical security against covert communication in every monitored data centre is challenging. Hardware trust. Waits on Tamper evidence for verifier devices ¹
  • A mass-manufacturable, good-enough side-channel defence, particularly power-line filtering, has not been constructed or red-teamed. Coverage & hidden compute. Waits on Side-channel suppression for isolated facilities ¹
  • Distinguishing one server's DRAM contents from another's by challenge-response timing, and a general challenge-response protocol for diverse data types, are open. Coverage & hidden compute. Waits on Timed challenge-response and memory-occupation challenges ¹
  • The threat model is under-developed and needs input from cybersecurity and AI threat-modelling experts. Adversarial validation ¹
• Deterministic and bit-exact inference
  • Batch-invariant kernels cost throughput: in Thinking Machines' Qwen3-8B test, an improved deterministic build took 42 s against 26 s for vLLM's default, and SGLang reports an average 34.35% slowdown on its FlashInfer and FlashAttention 3 backends. Performance & compatibility ^{5 7}
  • Coverage is incomplete: the bit-exact emulator targets dense blocks on NVIDIA GPUs and excludes mixture-of-experts inference and training, and vLLM's batch-invariant mode is in beta, with open work on AMD hardware and speculative decoding. Performance & compatibility ^{4 8 23}
  • Amodo's status page for the AI 2040 verification plan rates a reproducible inference stack for that plan as 'not started'. Performance & compatibility ²⁴
  • Exact replay requires the prover to disclose weights, software versions, parallelism and batch sizes to whoever recomputes. Privacy & leakage ^{1 4}
• Timed challenge-response and memory-occupation challenges
  • No network-level memory challenge across data-centre servers has been demonstrated. Adversarial validation ¹
  • Challenges that fill memory displace workloads; filling a pod's volatile memory takes tens of minutes and SSDs take hours. Performance & compatibility ^{1 15}
  • Outside help, such as remote memory, must be excluded during challenges. Coverage & hidden compute. Waits on Bandwidth limits and compartmentalization ¹

From the family or selected implementation's record. ?

Model weights

Depends on the design for Deterministic and bit-exact inference.

Not involved: Timed challenge-response and memory-occupation challenges.

Unspecified for Side-channel suppression for isolated facilities. Check the implementation record.

Inputs and outputs

Depends on the design for Deterministic and bit-exact inference.

Not involved: Timed challenge-response and memory-occupation challenges.

Unspecified for Side-channel suppression for isolated facilities. Check the implementation record.

Training data

Not involved: Deterministic and bit-exact inference and Timed challenge-response and memory-occupation challenges.

Unspecified for Side-channel suppression for isolated facilities. Check the implementation record.

Side-channel suppression for isolated facilities

• R1 AI 2040 inference-only verification stack Proposed architecture, AI Futures Project
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R1 RAND secure inference data center (SIDC) design Proposed architecture, RAND

Deterministic and bit-exact inference

• R2 Batch-invariant inference kernels (Thinking Machines) Open-source project, Thinking Machines Lab
• R3 Verde and RepOps (Gensyn) Product, Gensyn
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute

Timed challenge-response and memory-occupation challenges

• R1 Data-centre memory challenging Proposed architecture, Machine Intelligence Research Institute
• R2 GPU contention probes Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R2 SAGE Research prototype
• R2 VRAM-residency challenge Research prototype

1. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
2. Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors, N. Cankaya et al. (2026). Original
3. Suppressing Side Channels in an Untrusted Data Center via Retrofitted Defenses, N. Cankaya (2026). Original
4. Bit-Exact AI Inference Verification Without Performance Tradeoffs, N. Cankaya (2026). Original
5. Defeating Nondeterminism in LLM Inference, H. He & Thinking Machines Lab (2025). Original
6. Hawkeye: Reproducing GPU-Level Non-Determinism, E. Badash et al. (2026). Original
7. Towards Deterministic Inference in SGLang and Reproducible RL Training, The SGLang Team (2025). Original
8. Batch Invariance (vLLM documentation), vLLM project (2026). Original
9. gensyn-ai/ree: Gensyn Reproducible Execution Environment (GitHub repository), Gensyn (2026). Original
10. EigenCloud Brings Verifiable AI to Mass Market with EigenAI and EigenCompute Launches, EigenCloud (2025). Original
11. Building Delphi: Pricing, Settlement, and Agentic Trading, D. Jedamski (2026). Original
12. Reproducible Execution Environment (REE) (Gensyn documentation), Gensyn (2026). Original
13. What is Delphi? (Delphi documentation), Gensyn (2026). Original
14. Verification Plan, R. Dean (2026). Original
15. Timing and Memory Telemetry on GPUs for AI Governance, S. K. Monfared et al. (2026). Original
16. SAGE: Software-based Attestation for GPU Execution, A. Ivanov et al. (2023). Original
17. SWATT: SoftWare-based ATTestation for Embedded Devices, A. Seshadri et al. (2004). Original
18. Proofs of Space, S. Dziembowski et al. (2015). Original
19. Secure Code Update for Embedded Devices via Proofs of Secure Erasure, D. Perito & G. Tsudik (2010). Original
20. Software-Based Memory Erasure with Relaxed Isolation Requirements, S. Bursuc et al. (2024). Original
21. On the Difficulty of Software-Based Attestation of Embedded Devices, C. Castelluccia et al. (2009). Original
22. Refutation of "On the Difficulty of Software-Based Attestation of Embedded Devices", A. Perrig & L. van Doorn (2010). Original
23. [Feature]: Batch Invariant Feature and Performance Optimization (vLLM issue #27433), vLLM project contributors (2025). Original
24. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original