Implementations · AI Verification Landscape

Implementations

An implementation is a specific system that realises one or more mechanisms: a research prototype, a product, an open-source project or a proposed architecture.

Name	Category	Readiness	Verifies	Threat model
Attestable Audits A research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results. Provider-reported	On-chip	R2Demonstrated	The declared model is the one being served	Semi-trusted prover
DiFR (Divergence From Reference) DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Adversarial prover
Pearl proof-of-useful-work blockchain A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code. Provider-reported	Crypto / compute	R2Demonstrated		Adversarial prover
Tinfoil model identity (Modelwrap) Tinfoil's method for proving which model weights its enclave-hosted inference service runs, by binding a dm-verity hash of the weights into remote attestation. ⚠ Open critical flaw Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Semi-trusted prover
TOPLOC TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Adversarial prover
zkLLM zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Adversarial prover
AI 2040 inference-only verification stack A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs. Provider-reported	Isolation & architecture	R1Proposed	This compute runs inference, not training	Adversarial prover
Attestable zero-knowledge inference prover Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second. Provider-reported	Crypto / compute	R1Proposed	The declared model is the one being served	Adversarial prover
Low-trust AI compute verification system overview A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records. Provider-reported	Isolation & architecture	R1Proposed	This compute runs inference, not training	Adversarial prover
Lucid sovereignty (location) certificates A draft specification, hosted by Lucid Computing, for short-lived certificates that bound where a workload runs by timing signed exchanges with fixed anchors. Provider-reported	Accounting	R1Proposed	Chips are where they are declared to be	Semi-trusted prover
RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. Provider-reported	Isolation & architecture	R1Proposed	Model weights or data have not left the facility	Semi-trusted prover
SASH confidential network logger An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference. Provider-reported	Off-chip devices	R1Proposed	This compute runs inference, not training	Semi-trusted prover