A verifier measures how much information leaving a facility the declared work cannot explain.
If the declared model and recorded inputs predict the outputs, little room remains to smuggle out weights or results of hidden work. One proposed design routes all traffic through a verifier-controlled interlock and challenges the operator to show that randomly chosen outputs follow from compliant computation. As of September 2026 it has no published prototype results.
A version for language-model inference, with public code, cut what an attacker could hide to under 0.5% of the outputs' theoretical capacity, so exfiltration was more than 200 times slower. That result held for a 30-billion-parameter model under benign prompts, at a false-positive rate below 0.01%.
An independent study showed that attacker-chosen prompts roughly double leakage per token. The main obstacles are closing every other channel, including side channels, and tolerating numerical noise without leaving room for a covert channel.
R2 through the inference-output instance, which has public code and an independent attack study; the facility-level architecture is still a proposal.
Assessed use: bounding how much hidden information can leave in checked inference outputs
On this page
How it works
The idea is to measure the information that leaves a facility against what its declared work would produce 1. Petrie and Mühlhäuser propose verifying AI compute agreements by bounding the amount of unexplained information in network outputs, without either party trusting the other's hardware 1.
- Isolation and commitment. The prover's compute nodes are isolated, and all traffic passes through a verifier interlock that records cryptographic commitments of the encrypted traffic 1.
- Prediction challenges. From time to time the verifier challenges the prover to show that randomly selected outputs can be predicted by a policy-compliant computation on the measured inputs 1.
- Principle. The better compliant computation predicts the outputs, the less bandwidth is left for exporting the results of undeclared workloads 1.
- Confidentiality. The prover can recompute inside a verifier-controlled enclosure, the verifier can recompute inside a prover-controlled enclosure, or zero-knowledge proofs can be used 1.
For language-model inference, Rinberg et al. make this concrete. Honest inference follows a well-defined generative process, so hiding data in responses must make them deviate from expected model behaviour 2. A verification server re-runs sampled requests with the trusted model and the shared random seed, scores how plausible each emitted token is, and bounds the rate at which hidden bits can pass unnoticed 2. See Sampled inference recomputation.
A related line of work uses compression 5 6. Greenblatt's upload-limit proposal compresses each response with a weaker reference model, using arithmetic coding, so that only bits the reference model did not predict count against an upload limit 6. Rinberg and co-authors note that limiting egress rests on a simple fact: if only 10 GB leaves a data centre, no attacker can steal more than 10 GB 5. Language-model text compresses far better than model weights, so a facility can apply stricter egress limits 5.
What it establishes
It can put an upper bound on the covert information in checked outputs, which slows exfiltration rather than stopping it 2. Under benign prompt traffic, Rinberg et al. report that exfiltratable information fell to under 0.5% of the outputs' theoretical capacity, so exfiltration was more than 200 times slower 2 3. One I/O fingerprinting design extrapolates this benign-prompt result to a 200,000-GPU inference cluster at full load. Taking under 0.5% of about 17 bits per token, or about 0.1 bits per token surviving replay checks, it estimates about 40 Mbit/s 8.
It does not show that explained outputs are harmless, that no smaller model is being prepared, or anything about other channels:
- The bound covers only unexplained information 1. Compression research notes that someone with inference access can extract more proprietary information per bit than naive transmission allows 5.
- Greenblatt's upload-limit proposal lists running a distillation job inside the data centre, to produce a smaller model that is easier to move, as a residual route 6. Its author judges this hard to do without detection 6.
- The inference scheme treats side channels as out of scope 2.
Threat model
- Facility-level design. Neither party trusts the other's hardware, and the prover's compute can be isolated behind the interlock 1.
- Inference scheme. An insider controls the server's outputs, and outsiders may fully control the prompts 2. The scheme also assumes trusted verification code, secure logging, a private choice of which outputs to check that the adversary cannot manipulate, and randomness that is trusted and non-malleable 2. The reported bound was measured on benign prompts from a public chat dataset, and the authors call its size under adversarial prompts an open empirical question 2. An independent study has since measured it 4.
- Upload limits. Greenblatt's proposal assumes strong physical security 6. It also expects that a lab's most powerful model will not generate more than one or two orders of magnitude more tokens than it saw in training 6.