Technical detail · Hardware-enabled guarantees (flexHEG) and guarantee processors

Interlock. A flexHEG component on the data path is called an Interlock. As the only path for data and instructions into the accelerator, it could monitor or control that flow and encrypt what leaves the enclosure. The candidate points are HBM, NVLink, PCIe and the cluster NIC ².
Encryption cost. Part II roughly estimates that encrypting all NVLink traffic with AES-256-GCM would take about 3% of computing power, energy or board space, and encrypting all HBM traffic about 11% of power ².
Checking and logging. Part II estimates that for a guarantee processor to double-check one streaming multiprocessor (SM) of a Blackwell chip would take roughly 1/192 of the chip's compute, assuming 192 SMs per chip ². NVIDIA states that the Blackwell GPUs in its HGX B200 system normally have 148 SMs ³. Storing a FLOP log for 1M unique sources, such as a very large cluster, would take roughly 30 MB ².
Updates. An update, or the lack of one, could require approval by k of n parties. Periodic licenses could specify a minimum firmware version, and signatures should ideally be quantum-resistant ². A guarantee processor could be required to install a firmware update regularly, for example every three months, or it would block the chip ¹.
Enclosure. Tamper evidence is sufficient for verification, while guarantees about future use need tamper response. Options include capacitor discharge or antifuses that disable the chip, PUF-derived keys, and sensors for radiation, voltage glitching, lasers and temperature ².
Manufacturing oversight. Part III proposes extensive testing of a random sample, for example 1/1000 of finished devices, which would give a 63% chance of catching a batch of 1000 compromised devices at that stage ⁴.
RAND designs. An offline license might authorize 10^18 operations before the GPU falls back to 1% performance. A "fixed set" restricts high-bandwidth links to pre-authorized pods of fewer than 65 chips ⁵.