The Singapore AI Safety Hub (SASH) confidential network logger is a prototype for showing that a data centre serves inference, not training.
SASH describes confidential network loggers (CNLs) as systems that split and copy outgoing traffic on a data centre's cable. In the planned next prototype, an FPGA would certify the traffic it sees. A separate recomputation cluster would re-run a random sample of requests on its own model copy and flag mismatches.
The verifier would see only encrypted hashes. The first prototype's public code re-runs every request instead of a sample and computes no hashes. A hardware demonstration used DGX Spark GPUs and Raspberry Pis.
As of September 2026 it has not been tested at realistic scale or against a stated adversary. SASH says the recomputation cluster's security cannot yet be monitored, that a Raspberry Pi logger ties the design to particular supply chains, and that side channels remain.
Public code exists, but it runs a toy model through a software proxy with no stated adversary.
Assessed use: telling inference from training on a mutually inspected cluster
On this page
What it is
The Singapore AI Safety Hub (SASH) describes an international collaboration to build inference-verification mechanisms that distinguish model inference from training in data centres 1. Its early partners include the Oxford Martin AI Governance Initiative and the Future of Life Institute 1. The researchers span Singapore, the US, the UK, Hungary, Canada and Germany 1.
The core component is a Confidential Network Logger (CNL): "specialised traffic analysis systems which split and copy network traffic coming out of a cable" 1. SASH argues that, unlike on-chip mechanisms, CNLs "can be installed on most datacenters" 1. The first prototype is published as open-source code under the MIT licence, and its README calls it "a prototype demo for verifying LLM inference" 2. It implements network logging combined with recomputation. SASH's planned next prototype samples requests, while the published code re-runs all of them 1 2.
How it works
SASH describes the flow planned for its next prototype as follows 1:
- An FPGA placed between the host's cluster and its output gateway issues "cryptographic certificates attesting to the encrypted traffic it has seen" as traffic passes through 1.
- A random sample is sent to a recomputation cluster "which has been mutually inspected by both parties" and houses another copy of the model 1.
- The cluster recomputes the received inputs, and an alarm is triggered if the outputs do not match 1.
SASH says the verifier would see only "encrypted hashes" of inputs and outputs, so it can tell whether they match without reading them 1. SASH calls distinguishing inference from training "a promising early avenue" because their traffic is "structurally different" 1. It describes inference as many small bursts of activity on relatively few GPUs, and training of large models as sustained, cyclical activity on many GPUs 1.
The published code splits the system into a gateway, a network logger, a main cluster, a recomputation cluster and a dashboard 2:
- The gateway encrypts each request and passes it to the logger 2.
- The logger forwards it to the main cluster, then sends the request and response to the recomputation cluster, and releases the response only if the check passes 2.
- The recomputation cluster re-runs the request and compares the response text for an exact match 2.
In this version, every request is forwarded for verification and no hashes of the traffic are computed; the random sampling and hashes described in the blog post belong to the planned next prototype 1 2. Reproducible inference, which exact matching needs, is covered in Deterministic and bit-exact inference.