Model fingerprint attestation is a proposal to check that a declared model is loaded in a chip's memory.
The Oxford Martin AI Governance Initiative's verification report describes fresh challenges that would need the model or an assigned shard already in memory to answer before a deadline. Loading the model after receiving the challenge would take too long. A neutral cluster holding a copy of the model could check answers later.
The report proposes challenging all declared inference chips simultaneously to prevent them covering for one another. It leaves the challenge construction to future work. Its roughly 50 ms ceiling is a design target, without a measured implementation 1.
The report specifies a model-residency goal, a timing-based design and its assumptions, while leaving the challenge itself to future work 1.
Assessed use: checking residency of declared model weights with timed challenges
On this page
What it is
Model fingerprint attestation is a proposal in the Oxford Martin AI Governance Initiative's Verification for International AI Governance report to show that a specified model is loaded in memory on specified hardware 1. Its timed variant applies timed challenge-response to the model's weights 1. The report also describes remote attestation and confidential computing as simpler ways to establish model residency 1. TEE-based weight binding is covered in Hardware-attested weight binding.
How it works
- The verifier generates an unpredictable challenge immediately before sending it. The proposed computation would need the declared model or an assigned shard already in memory 1.
- The prover answers within a short deadline. The report assumes loading a different model would take seconds or longer. The deadline is intended to rule out loading it after the challenge 1.
- A neutral cluster with a copy of the model checks the answers later, potentially in batches. The verifier need not know the expected answer when sending the challenge 1.
An expanded design challenges all declared inference chips simultaneously to prevent declared chips covering for one another 1. Footnote 437 proposes a maximum of about 50 ms with little interruption to ongoing inference. If using the whole model is too costly, it suggests selecting a random portion of the weights from the challenge, with a tighter deadline 1.