Mechanism · Cryptographic & computational
Confidential multi-party verification
Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.
Also called Confidential audits; Attested confidential workflows; Trustless audits
Summary
Many verification questions involve assets that their owners will not show anyone, such as a developer's model weights, an auditor's test data or users' logs. Confidential multi-party verification runs the agreed check where no participant can see the others' inputs, either inside hardware-isolated enclaves that sign what code ran or with zero-knowledge proofs. Only the result is released, with evidence of how it was produced. Research prototypes compose multi-step audit workflows on commercial enclaves, run safety benchmarks without revealing the model or test data, limit usage monitoring to a jointly signed plan, and prove audits of small models with zero-knowledge proofs. As of September 2026 none is documented as relied on for a verification decision, and none has been independently red-teamed. The main obstacles are the limited scale of enclaves and proof systems, and trust in hardware vendors. Even a one-bit verdict can leak information about the private inputs.
R2: open-source and peer-reviewed prototypes work on production enclaves and small models, but none is relied on or independently evaluated.
Rubric assessment
- R1 met: designs that state what is verified and what is trusted are published for TEE workflows 1 2 and zero-knowledge audits 3.
- R2 met. Cove has an open-source reference implementation on Intel TDX via Phala Cloud's dstack, and its authors report an end-to-end attested confidential benchmark workflow on that production enclave platform 1 2. ZkAudit reports peer-reviewed end-to-end audits of MobileNet image classifiers and a recommender model 3. Attestable Audits ran safety benchmarks on an 8-billion-parameter model in AWS Nitro Enclaves 4.
- R3 not met. Criterion (a) fails: no party other than a developer is documented as relying on these systems for a verification decision, and they are research prototypes. Criterion (b) fails: no independent audit or red-team of Cove, Attestable Audits or ZkAudit has been published. An independent analysis of one monitoring tool's published evaluation found that its one-bit verdicts leak information 7.
Confidence is medium: prototypes exist, but at small model scales or on CPU-only enclaves 4 3.
- Reliance by a party other than the developer on a confidential multi-party workflow for a verification decision, or a production-grade system that is generally available.
- An independent security evaluation (audit, red-team or peer-reviewed analysis) of a workflow system such as Cove.
- Demonstration with frontier-scale models on GPU enclaves or with zero-knowledge proofs at that scale.
How it works
Audits often need sensitive artifacts, such as model weights and evaluation data, held by parties who do not trust each other 1. Model providers have business reasons to keep models and data secret, while society needs algorithmic transparency 3. Confidential multi-party verification moves the agreed check to a place where no single party sees the others' inputs 1 3.
- Composable enclave workflows. Cove uses trusted execution environments (TEEs) to compose reusable multi-stage audit workflows 1. In its developers' design, each data owner encrypts its artifact locally and approves only specific, hashed workflow steps 2. A key is released only to an enclave whose attestation matches an approved step 2. Each step emits a certificate that the hardware binds to its code and outputs, and a verifier checks the whole chain, starting from the final certificate 2.
- Enclave-run audits. In Attestable Audits, the model provider and the auditor each encrypt their inputs to an enclave key 4. The enclave runs the benchmark and publishes to a transparency log an attestation that binds the model hash, the hash of the audit code and data, and the result 4.
- Plan-scoped monitoring. A monitoring party and a monitored party co-sign a plan, which an open-source classifier runs inside an attested TEE; scope changes need fresh signatures from both parties 5. The plan fixes the inputs, the computation steps and the outputs to be released 6.
- Zero-knowledge audits. In ZkAudit, a provider publishes cryptographic commitments to its dataset and weights, plus a zero-knowledge proof that the weights came from training on that data 3. It then answers audit requests by computing a function privately and releasing the output with a proof that the computation was correct 3.
- Designing what is disclosed. Minimal Information Disclosure treats the content of the released evidence as a design choice, and aims to minimize what the evidence reveals beyond the authorized result 7.
What it establishes
It can establish:
- that an agreed computation ran on committed or attested inputs and produced the released result, without revealing the inputs 3 2;
- in Attestable Audits, that the model answering a user is the one that was audited 4.
It cannot establish:
- that nothing was left out of the workflow, since auditors also need assurance that all activity is accounted for 8;
- that the released result reveals nothing else: in one analysis, a one-bit verdict let a predictor tell which of two groups a private request came from with 72.4% balanced accuracy, against 50% by chance 7;
- in ZkAudit, secrecy of the model architecture, which the proofs reveal 3.
Threat model
- Cove. Its developers state that it trusts Intel TDX and its attestation roots, Docker's enforcement of the generated configuration, pinned first-party components, and public source code with human review 2. It does not trust its own storage server, network routing or orchestration 2.
- Attestable Audits. All parties must trust the vendor of the confidential-computing technology, which was AWS in the prototype 4.
- ZkAudit. It rests on cryptographic assumptions, including binding and hiding commitments 3.
- Treaty setting. A governance analysis contrasts the confidential-computing adversary, a dishonest operator, with the adversary in a treaty setting: a state with physical access to data centres and leverage over hardware vendors 8.
Evidence
- Cove. Its authors show how its primitives express three applications: capability-attested inference, attested confidential benchmarks and bilateral capability verification 1. They report an open-source reference implementation on Intel TDX via Phala Cloud's dstack, demonstrated end to end on the benchmark workflow only 1 2.
- Attestable Audits. The authors ran MMLU, XSum and ToxicChat on a 4-bit Llama-3.1-8B model in CPU-only AWS Nitro Enclaves 4. They report that CPU inference cost 21.7 times as much per token as GPU inference and ran about 100 times slower 4.
- ZkAudit. Peer-reviewed at ICML 2024 3. The authors audited MobileNet v2 image classifiers on three datasets, with accuracy 0.5–0.7 percentage points below full precision, and a small recommender whose error matched full precision 3.
- Auditor-in-a-Box. A reference implementation runs in Tinfoil confidential virtual machines 6. Its authors state that user data and plan execution in the demo are not actually secure, and that it has not been stress-tested by a counterparty 6.
Limitations
- Verdict leakage. Abdelghafar and Kulp found that one-bit reports can reveal sensitive attributes 7. They propose designing the evidence itself to limit this 7.
- Physical attacks on TEEs. Researchers interposing on the memory bus extracted a per-CPU Intel attestation key and forged TDX attestations 9. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone before AMD's fix 10 11.
- Stack trust. Compromise of the Docker daemon, host kernel or TEE stack breaks Cove's guarantees 2.
- Scale. Frontier model inference typically needs the resources of several GPUs 8, and ZkAudit was shown on image classifiers and a recommender model, not frontier-scale language models 3.
- Process. Plan negotiation, false positives and appeals remain open problems 6.
For attesting that a declared safeguard ran on a single service, see Safeguard attestation.
Known flaws
Published flaws, with their severity, kind and status. How flaws are rated.
Released verdicts can leak information about private inputs
Even a one-bit result can reveal more than intended. Abdelghafar and Kulp used the published evaluation of Auditor-in-a-Box, whose output filter is meant to disclose at most one bit. Given only the valid or invalid decision on a new request, a simple predictor identified which of two request sets it came from (borderline or proxy requests versus ordinary research requests) with 72.4% balanced accuracy, against 50% without the decision. In a second experiment, which distinguished reinforcement-learning workloads from others, several candidate one-bit reports revealed exact-workload information.
Sources: [7]Memory-bus interposition extracts attestation keys and forges attestations
With physical access to a server's DDR5 memory bus, researchers extracted a per-CPU Intel attestation provisioning key and forged TDX attestations. Against AMD SEV-SNP the same attack recovered a signing key used inside the virtual machine, not an AMD attestation key. Other attacks have forged SEV-SNP attestation: Battering RAM with an interposer on DDR4 servers, and RMPocalypse from a malicious hypervisor until AMD's firmware fix. By pairing forged TDX attestations with genuine H100 attestations relayed from rented hardware, they made a workload without TEE protection appear to run under GPU confidential computing. Intel, AMD and NVIDIA acknowledged the findings. Cove's reference implementation trusts Intel TDX attestation roots.
Guarantees depend on the host software stack and on review
Cove's developers state that compromise of the Docker daemon, host kernel or TEE stack breaks all guarantees. They also state that Docker policy alone cannot prove that guest code cannot generate a quote if the platform exposes quote instructions globally, and that compiled workflow bundles are hashed and reviewable but not signed by a publisher key.
Sources: [2]Completeness is not established
A confidential workflow proves facts about the records and models submitted to it. A governance analysis notes that an auditor also needs assurance that all activity is accounted for, since a host could start a second confidential virtual machine that uses a different model or bypasses monitoring.
Sources: [8]Zero-knowledge audits reveal model architecture
ZkAudit keeps weights and data secret but reveals the model architecture, and it does not protect against data poisoning.
Sources: [3]
Blockers
GPU confidential computing is less mature than CPU support and frontier inference typically needs the resources of several GPUs; a CPU-only enclave audit prototype ran at 1.84 tokens per second.
Zero-knowledge audits have been shown on image classifiers and a recommender model, not language models at frontier scale, and a counterfactual audit of the recommender cost $8,456.
Trust rests on a small number of hardware vendors, and a per-CPU Intel attestation key has been extracted by physical attack.
Parties must negotiate the plan or workflow and handle false positives and appeals, which the Auditor-in-a-Box authors list as open problems.
Released evidence must be designed to limit collateral leakage, which requires declaring protected properties in advance and calibrating on labelled executions.
Technical detail
Show technical detail
- Cove object model. An artifact is a unit of private data with exactly one owner, encrypted locally before upload. A workflow is a directed acyclic graph with a canonical serialization, and its hash names the bundle. Compilation to per-node manifests is deterministic, and the manifest hash is the node's identity. Owners record allow rules that bind each artifact to approved manifest hashes 2.
- Cove run and verification. At run time a node fetches and verifies upstream certificates, evaluates preconditions, obtains decryption keys only after attestation, runs the workload and emits a certificate whose TEE report data commits to the certificate-body hash. Report data is two SHA-256 hashes, of a fixed label and of a canonical payload. Verifiers start from a terminal certificate, the workflow bytes and the TEE vendor's roots, and check each certificate recursively 2.
- ZkAudit. The provider publishes commitments to its dataset and weights, with a zero-knowledge proof that the committed weights result from training. It then answers each audit request by computing a function F privately and releasing F's output with a second proof 3. A copyright or demographic audit of a MobileNet v2 model on Flowers-102 cost $108 in total (about 10 cents per image), and a counterfactual audit of a recommender on MovieLens cost $8,456 3.
- Minimal Information Disclosure. It chooses the evidence mechanism to minimize the conditional mutual information between protected properties and the released evidence, subject to a floor on information about the authorized target. One variant proves a linear projection with a Groth16 zk-SNARK 7.
Sources
- BS. Ding et al. (2026). Cove: Compositional Multi-Party Confidential Workflows for Verifiable AI Governance. ICML 2026 Workshop on Technical AI Governance Research. Source recordSupports: problem statement; framework; three applications; open-source implementation on Intel TDX via dstack · abstract (read via the ICML 2026 virtual poster page; the OpenReview PDF was not reachable)
- Bcovehub (2026). Cove: Compositional Multi-Party Confidential Workflows for Verifiable AI Governance (reference implementation). GitHub. Source recordSupports: object model; lifecycle; certificates; trust boundary; residual risks · README; docs/internal/architecture.md; docs/internal/security_model.md
- AS. Waiwitlikhit et al. (2024). Trustless Audits without Revealing Data or Models. 41st International Conference on Machine Learning (ICML 2024). Source recordSupports: ZkAudit protocol; models and datasets; accuracy; costs; assumptions; architecture disclosure; data poisoning · abstract; §5; Tables 1-4; limitations
- BC. Schnabl et al. (2025). Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments. ICML 2025 Workshop on Technical AI Governance. Source recordSupports: multi-party enclave audit protocol; transparency log; prototype and throughput; CPU versus GPU cost and slowdown; vendor trust · §3; §4; §5; Table 2
- BB. Penchas et al. (2026). Enabling Verifiably-Scoped Monitoring through Large Language Models and Trusted Compute. ICML 2026 Workshop on Technical AI Governance Research. Source recordSupports: plan-scoped monitoring protocol · abstract
- CR. Rinberg & B. Penchas (2026). Auditor-in-a-Box: Tools for Third-Party Auditing. LessWrong. Source recordSupports: plan definition; reference implementation; process problems; limitations · whole post
- BS. Abdelghafar & G. Kulp (2026). Privacy-Preserving AI Verification via Minimal Information Disclosure. arXiv. Source recordSupports: minimal information disclosure framework; one-bit leakage findings; Groth16 variant; limitations · abstract; introduction; Appendix A; Figure 5; limitations
- CGloria Z (2026). On TEEs for Privacy-Preserving Monitoring in AI Governance. MIRI Technical Governance Team. Source recordSupports: completeness and second-CVM gap; vendor root of trust; GPU TEE maturity; multi-GPU inference; treaty threat model · resource accounting; hardware auditability; physical attack surface
- AJ. Chuang et al. (2026). TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition. 2026 IEEE Symposium on Security and Privacy (SP). Source recordSupports: physical extraction of Intel attestation keys and SEV-SNP signing keys; forged attestations against NVIDIA GPU confidential computing; vendor acknowledgement · project site summary; paper abstract and disclosure
- AJ. De Meulemeester et al. (2026). Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing. 47th IEEE Symposium on Security and Privacy (S&P 2026). Source recordSupports: Battering RAM forges SEV-SNP attestation with a DDR4 interposer
- AB. Schlüter & S. Shinde (2025). RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP. 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25). Source recordSupports: RMPocalypse forges SEV-SNP attestation from a malicious hypervisor
- BAMD (2025). SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020). AMD product security bulletin. Source recordSupports: AMD firmware fixes for RMPocalypse (CVE-2025-0033)