Map · AI Verification Landscape

Map

Every mechanism and implementation, placed by the claim it addresses and its category. The code before each name is its readiness level. Entries in grey italics play a supporting role rather than a primary one. ⚠ marks an open critical flaw.

Claim ↓ · Where the mechanism sits →	On-chip	Off-chip devices	Crypto / compute	Isolation & architecture	Accounting	Sensing
Compute stock is at most a declared amount A party holds no more AI-relevant compute, counted in chips or equivalent capacity, than the total it has declared.	R1Hardware performance throttling and licensing	—	—	—	R1Chip registries and manufacturing records	R1Remote detection of data centres
Chips are where they are declared to be Specific AI chips are physically located at the sites a party has declared, throughout the declared period.	R1Hardware-enabled guarantees (flexHEG) and guarantee processors	—	R1Timed challenge-response and memory-occupation challenges	—	R1Chip location verification R1Lucid sovereignty (location) certificates R1Chip registries and manufacturing records	—
Declared hardware is idle or shut down Specified AI chips or facilities are not performing computation, or are powered off, throughout a declared period.	R2On-chip telemetry from timing, memory and performance counters⚠ R1Hardware performance throttling and licensing	—	R1Timed challenge-response and memory-occupation challenges R1Proofs of useful work and resource exhaustion	—	—	—
This compute runs inference, not training A declared cluster is used only to run existing models to produce outputs, and not to train new or more capable models.	R2On-chip telemetry from timing, memory and performance counters⚠ R2TEE remote attestation for AI workloads⚠	R1Network taps and certifiers R1SASH confidential network logger R2Tamper evidence for verifier devices R1Side-channel suppression for isolated facilities	R2Deterministic and bit-exact inference R2Sampled inference recomputation R2Zero-knowledge proofs of inference R1Proofs of useful work and resource exhaustion R1Timed challenge-response and memory-occupation challenges R1Attestable zero-knowledge inference prover	R1Reproducible computation packets R1AI 2040 inference-only verification stack R1Low-trust AI compute verification system overview R2Bounding unexplained information in outputs R1Bandwidth limits and compartmentalization R1Memory wiping and proofs of secure erasure R1RAND secure inference data center (SIDC) design	—	R2Workload classification from telemetry and side channels
The declared model is the one being served Outputs delivered to users or auditors come from the specific model, weights and configuration the provider declared, not from a substitute.	R2TEE remote attestation for AI workloads⚠ R2Attestable Audits R1Hardware-enabled guarantees (flexHEG) and guarantee processors	R1Network taps and certifiers R1SASH confidential network logger	R2Confidential multi-party verification R2Deterministic and bit-exact inference R2Model identity attestation⚠ R2Sampled inference recomputation R2Zero-knowledge proofs of inference R2DiFR (Divergence From Reference) R2Tinfoil model identity (Modelwrap)⚠ R2TOPLOC R2zkLLM R1Attestable zero-knowledge inference prover R2Safeguard attestation	R1AI 2040 inference-only verification stack R1Low-trust AI compute verification system overview R1RAND secure inference data center (SIDC) design	—	—
Declared safeguards were applied during inference Specified safety measures, such as input filters, output checks or monitoring, actually ran on the requests a deployed model served.	R2TEE remote attestation for AI workloads⚠ R2Attestable Audits R1Hardware-enabled guarantees (flexHEG) and guarantee processors	—	R2Safeguard attestation R2Confidential multi-party verification R2Model identity attestation⚠ R2Zero-knowledge proofs of inference R1Attestable zero-knowledge inference prover	R1Low-trust AI compute verification system overview	—	—
A training run stayed within declared limits A declared training run used no more compute than permitted and had its declared properties, such as data, hyperparameters and resulting weights.	R1Hardware-enabled guarantees (flexHEG) and guarantee processors R2On-chip telemetry from timing, memory and performance counters⚠ R2TEE remote attestation for AI workloads⚠ R1Hardware performance throttling and licensing	—	R2Proof-of-learning and training-transcript verification⚠ R2Zero-knowledge proofs of training constraints R2Confidential multi-party verification	R1Bandwidth limits and compartmentalization R1Reproducible computation packets	—	R2Workload classification from telemetry and side channels
Communication between compute groups is bounded Data flowing between specified groups of chips, or out of a facility, stays below a declared rate, so the groups cannot jointly run large workloads.	R1Hardware-enabled guarantees (flexHEG) and guarantee processors	R1Side-channel suppression for isolated facilities R2Tamper evidence for verifier devices	—	R1Bandwidth limits and compartmentalization R2Bounding unexplained information in outputs R1AI 2040 inference-only verification stack	—	—
Model weights or data have not left the facility No copy of specified model weights or sensitive data has left a designated facility through networks, physical media or other channels.	—	R1Network taps and certifiers R1Side-channel suppression for isolated facilities	R2Deterministic and bit-exact inference R2Model identity attestation⚠ R2Sampled inference recomputation R2DiFR (Divergence From Reference)	R2Bounding unexplained information in outputs R1RAND secure inference data center (SIDC) design R1Bandwidth limits and compartmentalization	—	—
There is no undeclared relevant compute A party controls no AI-relevant computing hardware or facilities, above an agreed threshold, beyond those it has declared.	R2On-chip telemetry from timing, memory and performance counters⚠	—	R1Proofs of useful work and resource exhaustion R2Deterministic and bit-exact inference R2Pearl proof-of-useful-work blockchain	R1Low-trust AI compute verification system overview	R1Chip location verification R1Chip registries and manufacturing records	R1Remote detection of data centres

R0 Idea R1 Proposed R2 Demonstrated R3 Deployment-ready Filter these records instead →