Confidential multi-party verification

How it works

Audits often need sensitive artifacts, such as model weights and evaluation data, held by parties who do not trust each other ¹. Waiwitlikhit et al. argue that model providers have business reasons to keep models and data secret, while society needs algorithmic transparency ³. Confidential multi-party verification moves the agreed check to a place where no single party sees the others' inputs ^{1 3}.

• Composable enclave workflows. Cove uses trusted execution environments (TEEs) to compose reusable multi-stage audit workflows ¹. In its developers' design, each data owner encrypts its artifact locally and approves only specific, hashed workflow steps ². A key is released only to an enclave whose attestation matches an approved step ². Each step emits a certificate that the hardware binds to its code and outputs, and a verifier checks the whole chain, starting from the final certificate ².
• Commercial confidential workspaces. Google reports that its Confidential Space runs a workload on data from several parties and releases each party's data only to a workload whose attestation meets that party's conditions. The operator has no access to the data ¹¹. OpenMined's PySyft evaluation workflow used it in a 2026 pilot ⁹.
• Enclave-run audits. In Attestable Audits, the model provider and the auditor each encrypt their inputs to an enclave key ⁴. The enclave runs the benchmark and publishes to a transparency log an attestation that binds the model hash, the hash of the audit code and data, and the result ⁴.
• Plan-scoped monitoring. In verifiably-scoped monitoring, a monitoring party and a monitored party co-sign a plan, which an open-source classifier runs inside an attested TEE; scope changes need fresh signatures from both parties ⁵. In Auditor-in-a-Box, the plan fixes the inputs, the computation steps and the outputs to be released ⁶.
• Zero-knowledge audits. In ZkAudit, a provider publishes cryptographic commitments to its dataset and weights, plus a zero-knowledge proof that the weights came from training on that data ³. It then answers audit requests by computing a function privately and releasing the output with a proof that the computation was correct ³.
• Designing what is disclosed. Minimal Information Disclosure treats the content of the released evidence as a design choice, and aims to minimize what the evidence reveals beyond the authorized result ⁷.

What it establishes

It can establish:

• that an agreed computation ran on committed or attested inputs and produced the released result, without revealing the inputs ^{2 3};
• in the Attestable Audits design, that the model answering a user is the audited model, or the full model from which an enclave produced the audited quantized version ⁴.

It cannot establish:

• that nothing was left out of the workflow, since auditors also need assurance that all activity is accounted for ⁸;
• in Attestable Audits, that a full model served after its quantized version was audited would score the same: the conversion attestation records only that one is a quantized version of the other, and the authors report that 4-bit quantization slightly degrades benchmark performance ⁴;
• that the released result reveals nothing else: in one analysis, a one-bit verdict let a predictor tell which of two groups a private request came from with 72.4% balanced accuracy, against 50% by chance ⁷;
• in ZkAudit, secrecy of the model architecture, which the proofs reveal ³.

Threat model

• Double-blind pilot. Its guarantees hold for a user who trusts that the cloud provider and the hardware manufacturer have insufficient incentives to collude against them ⁹. Google's services sign and verify the attestation report, which the participants note places Google in the verification path ⁹. Google reports that, since 15 September 2026, Confidential Space on H100 GPUs is generally available with attestation through Intel Trust Authority, Intel's attestation verifier service ¹².
• Cove. Its developers state that it trusts Intel TDX and its attestation roots, Docker's enforcement of the generated configuration, pinned first-party components, and public source code with human review ². It does not trust its own storage server, network routing or orchestration ².
• Attestable Audits. All parties must trust the vendor of the confidential-computing technology, which was AWS in the prototype ⁴.
• ZkAudit. It rests on cryptographic assumptions, including binding and hiding commitments ³.
• Treaty setting. A governance analysis contrasts the confidential-computing adversary, a dishonest operator, with the adversary in a treaty setting: a state with physical access to data centres and leverage over hardware vendors ⁸.