Attestable Audits, from University of Cambridge researchers, lets a model provider and an auditor who do not trust each other run a benchmark on a confidential model.
Both send their inputs, encrypted, to a trusted execution environment (TEE): the provider its weights, the auditor its test code and data. The enclave runs the audit and publishes an attestation that links the model's hash, the audit and the result. A specified but unevaluated inference step lets users check that the answering model is the audited one, or the full model whose enclave-quantized version was audited.
The authors' prototype on CPU-only AWS Nitro Enclaves ran a 4-bit Llama-3.1-8B on MMLU, XSum and ToxicChat benchmarks. CPU inference cost 21.7 times as much per token as GPU inference, and the enclave roughly doubled the CPU cost.
No code is linked. The design trusts the TEE vendor, and prompt-based model exfiltration remains an open gap.
One developer paper reports end-to-end results on commercial hardware, but there is no public code and no independent reproduction, so confidence is low.
Assessed use: attesting a benchmark audit run on a confidential model in an enclave
On this page
What it is
Attestable Audits is a protocol and prototype, described in a 2025 paper by four researchers in the University of Cambridge's Department of Computer Science and Technology 1. It targets a specific problem: benchmarks "typically do not offer verifiable results and lack confidentiality for model IP and benchmark datasets" 1. The design runs audits inside a TEE, so that a model provider and an auditor who do not trust each other can produce a result that users and regulators can verify 1. It is an implementation of TEE remote attestation for AI workloads, of confidential multi-party verification and, through its inference step, of hardware-attested weight binding.
How it works
The protocol has three steps 1:
- Prepare. This step is optional. The enclave attests its boot image and publishes a public key. The model provider sends its model, encrypted to that key. The enclave quantizes the model, hashes both versions and posts to a transparency log an attestation that links them.
- Audit. The provider sends the model, or its quantized version from Prepare, and the auditor sends its audit code and data, each encrypted. The enclave runs the audit in a sandbox and publishes an attestation that binds the model hash, the audit and the result.
- Inference. The enclave loads the earlier attestations and checks the served model's hash against them. The served model can be the audited one or, after Prepare, the full model. It then answers each encrypted prompt with an attestation that links the model, prompt, output and audit result.
Verifiers compare the enclave's measurement registers with known images and check the vendor's signature 1. The paper considers two adversaries: network attackers, and privileged or physical attackers who may take RAM snapshots, roll back VMs or use side channels 1.