Hardware-attested weight binding

How it works

Weight binding runs inside a trusted execution environment (TEE), a hardware-isolated enclave that produces a signed report, called an attestation, of the software it launched (TEE remote attestation for AI workloads). Tinfoil notes that attestation "measures launch state, not runtime state", and that weights are read from disk after boot ².

A launch measurement alone therefore does not show which weights the service later reads. The measured software must also check the weights against a hash commitment when it reads them. A check made once at load time does not stop a malicious hypervisor from altering the disk afterwards ².

Three designs bind the weights to the attestation:

• Tinfoil's Modelwrap packs the weights into a read-only image and computes a Merkle-tree root hash. It places that hash on the kernel command line, which the enclave measurement covers, and the kernel's dm-verity layer checks every block read against it ². Clients compare the attestation's measurements with values that Tinfoil's build pipeline publishes to the Sigstore transparency log ¹⁶. For Tinfoil's inference API, clients verify a router enclave, which makes this comparison for each model enclave before forwarding requests to it ¹⁶. For a public model, anyone can rebuild the image from the same Hugging Face commit and compare root hashes ².
• PAL*M puts hashes of each operation's inputs, including the model, and of its outputs into the Intel TDX report, for single prompts and multi-turn sessions ³.
• Attestable Audits records the model hash when an audit runs. At inference time it checks that the served model is the audited model, or a full model whose quantized version the enclave produced, attested and audited. It then returns each response with an attestation that links model, prompt, output and audit result ⁴.

The separate model fingerprint attestation proposal would use timed challenges to check that declared model weights are already in memory. The report leaves construction of a suitable challenge to future work ¹.

The Oxford Martin AI Governance Initiative's report sketches a model-tenancy ledger that records a fingerprint and timestamp whenever a model is loaded into memory ¹. The history would be kept in nonvolatile storage ¹. Remote attestation or local inspection could then reveal that history ¹. The report leaves open whether this model-tenancy ledger could be secured without relying on the hardware's private key ¹.

The same report sketches device-model mating: an encryption key derived from a tamper-responsive enclosure and a one-time model-installation lock would bind a model to one device ¹. It aims to prevent model copying and replacement, which would also block later model updates ¹. The report describes the hardware as highly speculative and leaves enclosure survival under normal environmental stress unresolved ¹.

What it establishes

Weight binding can show that the weights the attested software reads match a commitment ². That result depends on a genuine attestation and on requests reaching the attested TEE. TEE.fail made a proxy outside TEE protection pass attestation checks by forging and relaying attestations ¹⁰.

It cannot show what a private model can do, everything else that shapes behaviour, or properties that a weak hashing scheme leaves out:

• With unpublished weights, a user can confirm only that the same weights are served each time ². An attested evaluation bound to the same hash can close part of that gap ⁴.
• Tinfoil measures the firmware, kernel, initrd and a configuration file as well as the weights ¹⁶. Gloria Z, author of a June 2026 MIRI Technical Governance Fellowship post, warns that unmeasured runtime flags can undermine integrity ⁷. In a pre-launch audit of WhatsApp's TEE-based Private Processing, Trail of Bits found such a gap: configuration files with environment variables were loaded after the measurement, so an insider could have loaded malicious code without invalidating the attestation. Meta fixed it before launch ^{8 9}.
• Gloria Z also warns that a scheme that sequences values loosely, or checks the weights too early in loading, could let two models with significantly different properties share a hash "without breaking the hash function itself" ⁷.

Weight binding does not check what the model outputs. Sampled inference recomputation tests sampled outputs against the declared weights, and deterministic inference lets a verifier's re-run match exactly.

Threat model

Weight binding trusts the hardware vendor and treats the host software as hostile. Tinfoil states "You trust the hardware manufacturer", but not the hypervisor or host OS ¹⁵. PAL*M excludes side channels and physical attacks ³.

The binding also trusts the measured software inside the TEE to check every weight read against the commitment ².