Mechanisms

A mechanism is a general technique for verifying a claim about AI hardware or software. Mechanisms are grouped by category and sorted by development status. The Verifies column lists the claims each is aimed at, then, in grey italics, those it supports. Implementations realise one or more mechanisms.

On-chip & hardware-enabled (4)

Mechanisms built into accelerators or their firmware: trusted execution, attestation, hardware-enabled governance, on-chip telemetry and limits.

Name	Development	Security evidence	Verifies	Threat model
TEE remote attestation for AI workloads Trusted execution environments (TEEs) in CPUs and GPUs sign reports of launched software, so remote verifiers can check which code an AI workload started with. ⚠ Open critical failures Provider-reported	Operational use Operational use for showing a verifier which software ran despite distrust of the hardware operator. Medium confidence. Semi-trusted prover	Published attack testing · independent	The declared evaluation was run The declared model is the one being served Declared safeguards were applied during inference This compute runs inference, not training A training run stayed within declared limits	Semi-trusted prover
On-chip telemetry from timing, memory and performance counters On-chip measurements, such as task timings, whether data sits in chip memory, and performance counters, used as statistical evidence of what AI chips are running.	Research demonstration Research demonstration for workload evidence from GPU counters and timing, assuming authentic measurements. Medium confidence. Semi-trusted prover	Published attack testing · developers	This compute runs inference, not training Declared hardware is idle or shut down A training run stayed within declared limits	Semi-trusted prover
Hardware performance throttling and licensing Proposed on-chip mechanisms that cut an AI accelerator's performance when a license expires or a trusted trigger fires, bounding what the hardware can do.	Proposed Proposed for performance limits a verifier can rely on, against an operator trying to bypass them. Medium confidence. Adversarial prover	Published analysis or argument	Compute stock is at most a declared amount A training run stayed within declared limits Declared hardware is idle or shut down	Adversarial prover
Hardware-enabled guarantees (flexHEG) and guarantee processors A proposed add-on for AI chips: an auditable guarantee processor, sealed in a tamper-protected enclosure, that would check and enforce agreed rules on chip use.	Proposed Proposed for checking and enforcing training-compute limits on chips, against adversaries up to states. Medium confidence. Adversarial prover	Published analysis or argument	A training run stayed within declared limits The declared model is the one being served Chips are where they are declared to be Communication between compute groups is bounded Declared safeguards were applied during inference	Adversarial prover

Off-chip devices & sensors (3)

Retrofittable devices outside the accelerator: network taps and certifiers, power and analog sensors, tamper-evident enclosures.

Name	Development	Security evidence	Verifies	Threat model
Tamper evidence for verifier devices Enclosures, seals and sensors that make physical interference with verification hardware visible, or that destroy the hardware's secrets when tampering occurs.	Research demonstration Research demonstration for detecting probing of proposed verifier hardware, using server and electronics prototypes as evidence. Medium confidence. Adversarial prover	Published analysis or argument	This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
Network taps and certifiers Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.	Proposed Proposed for committing a complete record of cluster traffic, so declared inference can be checked. Medium confidence. Adversarial prover	Published analysis or argument	This compute runs inference, not training Model weights have not left the facility The declared model is the one being served A training run stayed within declared limits	Adversarial prover
Side-channel suppression for isolated facilities Shielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.	Proposed Proposed for bounding physical covert channels out of a verified enclosure. Medium confidence. Adversarial prover	Published analysis or argument	Communication between compute groups is bounded Model weights have not left the facility This compute runs inference, not training	Adversarial prover

Cryptographic & computational (10)

Protocols that check computation itself: recomputation, zero-knowledge proofs, proofs of learning, proofs of work, challenge-response.

Name	Development	Security evidence	Verifies	Threat model
Deterministic and bit-exact inference Making model inference reproducible bit for bit, so that a verifier's re-run must match the provider's output exactly rather than approximately. Provider-reported	Operational use Operational use for reproducing open-model inference from receipts in Gensyn's information-market service. Low confidence. Adversarial prover	Published analysis or argument	The declared model is the one being served This compute runs inference, not training Model weights have not left the facility	Adversarial prover
Hardware-attested weight binding Checks that a hardware enclave serves committed model weights, by attesting software that tests the weights against a hash commitment when they are read. ⚠ Open critical failure Provider-reported	Operational use Operational use for showing users, through hardware attestation, that a service runs its committed weights. Medium confidence. Semi-trusted prover	Published attack testing · independent	The declared model is the one being served Declared safeguards were applied during inference The declared evaluation was run	Semi-trusted prover
Sampled inference recomputation A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match. Provider-reported	Operational use Operational use for checking untrusted workers' activations against the declared model, prompt and precision. Low confidence. Adversarial prover	Published analysis or argument	The declared model is the one being served Model weights have not left the facility This compute runs inference, not training	Adversarial prover
Confidential multi-party verification Parties who distrust each other run an agreed check on private models or records, using attested enclaves or zero-knowledge proofs, releasing only the result.	Research demonstration Research demonstration for audits or evaluations of a private model that reveal neither party's inputs. Medium confidence. Semi-trusted prover	Published analysis or argument	The declared evaluation was run The declared model is the one being served Declared safeguards were applied during inference A training run stayed within declared limits	Semi-trusted prover
Safeguard attestation TEE-signed evidence that an AI service sent a given response through its declared safeguard path, such as a wrapper that calls a guardrail classifier. Provider-reported	Research demonstration Research demonstration for attesting that a declared safeguard mediated a service's responses. Low confidence. Semi-trusted prover	Published analysis or argument	Declared safeguards were applied during inference	Semi-trusted prover
Timed challenge-response and memory-occupation challenges A verifier times answers to unpredictable questions designed so that answering correctly and in time requires holding specified data locally or dedicating specified resources.	Research demonstration Research demonstration for detecting whether a GPU is doing other work. Medium confidence. Adversarial prover	Published analysis or argument	Declared hardware is idle or shut down This compute runs inference, not training Chips are where they are declared to be The declared model is the one being served	Adversarial prover
Training-transcript verification (proof-of-learning) A trainer logs checkpoints, data order and settings, so a verifier can re-run sampled training segments and check that the claimed training happened. ⚠ Open critical failure	Research demonstration Research demonstration for checking from its transcript that a training run followed declared rules. Medium confidence. Adversarial prover	Published attack testing · independent	A training run stayed within declared limits	Adversarial prover
Zero-knowledge proofs of inference A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.	Research demonstration Research demonstration for proving a language model's output follows from committed weights, against a cheating prover. Medium confidence. Adversarial prover	Published attack testing · independent	The declared model is the one being served This compute runs inference, not training Declared safeguards were applied during inference The declared evaluation was run	Adversarial prover
Zero-knowledge proofs of training constraints Cryptographic proofs that a training run used a dataset and followed a procedure and rules fixed in advance, checkable without seeing the model or data.	Research demonstration Research demonstration for proving a training run followed a committed specification and data. Medium confidence. Adversarial prover	Published analysis or argument	A training run stayed within declared limits	Adversarial prover
Proofs of useful work for capacity accounting Cryptographic evidence of matrix-multiplication work, from which total work is estimated statistically, proposed as one input to bounding the spare capacity of declared hardware. Provider-reported	Proposed Proposed for bounding the spare capacity of declared hardware that could run training. Low confidence. Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover

Isolation & system architectures (4)

Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.

Name	Development	Security evidence	Verifies	Threat model
Bandwidth limits and compartmentalization Capping or removing network links between groups of AI chips, so each can serve models but pre-training beyond the current frontier becomes far slower.	Research demonstration Research demonstration for monitoring inter-node traffic with operator-run software on four GPUs. Low confidence. Adversarial prover	Published analysis or argument	Communication between compute groups is bounded This compute runs inference, not training A training run stayed within declared limits Model weights have not left the facility	Adversarial prover
Bounding unexplained information in outputs Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.	Research demonstration Research demonstration for bounding how much hidden information can leave in checked inference outputs. Low confidence. Adversarial prover	Published attack testing · independent	Model weights have not left the facility This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
Memory wiping and proofs of secure erasure Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches.	Proposed Proposed for showing that no data from earlier work persists in memory the wipe reaches. Medium confidence. Adversarial prover	Published analysis or argument	This compute runs inference, not training	Adversarial prover
Whole-workload recomputation (reproducible packets) Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.	Proposed Proposed for recomputing whole workloads to show a cluster runs only declared inference. Medium confidence. Adversarial prover	Published analysis or argument	This compute runs inference, not training A training run stayed within declared limits	Adversarial prover

Compute accounting & provenance (2)

Establishing what compute exists, where it is and what it can do: chip registries, manufacturing records, location verification, capacity bounds.

Name	Development	Security evidence	Verifies	Threat model
Chip location verification Timing a chip's signed replies to trusted servers at known places, so that the speed of light bounds how far away the chip can be.	Proposed Proposed for bounding how far a chip is from trusted landmark servers when checked. Medium confidence. Adversarial prover	Published analysis or argument	Chips are where they are declared to be There is no undeclared relevant compute	Adversarial prover
Chip registries and manufacturing records Recording each AI chip's identity and owner from manufacture onwards, and publishing a cryptographic fingerprint of manufacturing records, so chips can be accounted for later.	Proposed Proposed for a checkable record of which chips were made and who declared owning them. Medium confidence. Semi-trusted prover	Published analysis or argument	Compute stock is at most a declared amount There is no undeclared relevant compute Chips are where they are declared to be	Semi-trusted prover

Remote & side-channel sensing (2)

Inferring activity from outside or from physical signals: detecting data centres, classifying workloads from power or other emissions.

Name	Development	Security evidence	Verifies	Threat model
Workload classification from telemetry and side channels Inferring from GPU counters or power draw whether chips are training models, serving them or doing non-AI work, without reading weights or data.	Research demonstration Research demonstration for telling training from inference and other work using genuine telemetry, including disguised workloads. Medium confidence. Adversarial prover	Published attack testing · developers	This compute runs inference, not training A training run stayed within declared limits	Adversarial prover
Remote detection of data centres Remote detection tracks known large data centres and estimates their power capacity without site access, using satellite imagery, heat signatures and public records.	Proposed Proposed for finding undeclared data centres above an agreed compute threshold. Medium confidence. Adversarial prover	Published analysis or argument	There is no undeclared relevant compute Compute stock is at most a declared amount	Adversarial prover