Network taps and certifiers

How it works

A network tap is a device that "mirror[s] network traffic without disrupting normal operation" ². Verification proposals use taps to build a record of what crossed a link, which the verifier can check later ^{2 3}. The MIRI system overview states the principle as "capture everything, challenge and audit random samples after" ³.

In the most detailed designs, the verifier never receives plaintext ^{3 1}. The tap hashes payloads over groups of packets, without knowing where objects such as prompts begin or end, and sends only hashes out; the operator (the prover) keeps the plaintext ^{3 1}. Later the verifier picks stored hashes at random, the prover supplies the matching data, and a verification facility replays the computation and checks that the hashes match ¹. A missing or mismatching preimage is a failure; a replay that does not reproduce points to false metadata or a technical fault ³.

The AI 2040 plan proposes a simpler variant: passive taps on the frontend network copy all input and output traffic to a recomputation server (Sampled inference recomputation, Reproducible computation packets) ⁴.

Taps can sit at three levels ²:

• North-south (frontend) links to the outside world, at an estimated material cost under 0.01% of the monitored data centre ².
• The storage fabric, which carries model loads, dataset reads and checkpoint saves, at an estimated 0.3–0.5% of data-centre cost ².
• The compute (east-west) fabric, at an estimated 0.2–1.5% of data-centre cost for its optical levels. Volumes there are so high that the note proposes sampling, for example 0.01% of traffic, about 20 Gb/s, through an optical circuit switch ².

For inference, the monitored perimeter could be as small as pods of a few hundred accelerators; monitoring training needs larger perimeters or taps on the compute and storage fabrics ³.

A key aim of the "Secure Gateway Device" design is that no processor has to be trusted by both sides ¹. It uses passive optical splitters, so that each party can watch the signals it must check, and coin-flip protocols to generate shared random values ¹. It also acts as an "active warden", rewriting free header fields and re-timing packets to close timing, analogue and header channels that checks on hashes cannot address ¹.

SASH's planned next prototype would place an FPGA between the cluster and its gateway to issue "cryptographic certificates attesting to the encrypted traffic it has seen" ¹⁰; see SASH confidential network logger.

What it establishes

The Secure Gateway Device paper aims to make it "infeasible to covertly exfiltrate the results of undisclosed workloads in the cluster through the tapped wires" ¹. Combined with replay, it would show that recorded outputs match declared workloads ^{1 4}; see This compute runs inference, not training and Model weights or data have not left the facility.

It does not establish:

• Device state. Taps capture flows, not device state; the MIRI overview treats memory probes as complementary ³.
• Absence of covert compute. A north-south tap does not directly prevent covert workloads, only the exfiltration of their results ¹. The paper judges it futile to block every single-bit leak. It argues that the residual risk, covert computation plus low-bandwidth signalling of results, needs other checks such as east-west taps and throughput accounting ¹.
• Permissibility or compliance. The paper does not decide which workloads should be allowed, or whether declared workloads comply ¹.

Threat model

• The operator and the verifier distrust each other. The operator must not hide information in the traffic, and the verifier must learn nothing beyond hashes ¹.
• The facility is physically monitored, so that all traffic passes through the gateway ¹.
• The operator stores all hashed data for the agreement's duration ¹.
• Replay needs reproducible inference (Deterministic and bit-exact inference) ^{3 1}.
• The MIRI overview models a covert adversary, deterred when the likelihood of detection times the cost of being caught exceeds the expected gain ³.

Evidence

• Designs and analysis. The Secure Gateway Device paper, Cankaya's feasibility note and the MIRI overview are design studies ^{1 2 3}. The paper states that empirical validation is still required and calls for red-teaming by specialists ¹.
• Commercial precedent. Taps are used for stock-exchange monitoring, packet capture, defence networks and lawful intercept ³. The MIRI overview says AI use needs changes for a nation-state covert adversary ³.
• Amodo's first tap test (March 2026). A passive multimode splitter on a link of about 10 Gbps copied both directions of traffic to a monitoring machine ⁵.
• Amodo's tap survey (May 2026). Commodity taps exist for 26 GBaud links, but none are advertised for 53 GBaud ⁶.
• Amodo's hashing benchmarks (July 2026). On an AMD EPYC server CPU, no tested hash algorithm reached line rate with 64-byte frames, and the tested DPU fell short of the 400 Gbps target ⁷.
• Amodo's tapped prototype (September 2026). A passive fibre tap on the 1 Gbps uplink of its inference-verification prototype fed a frame processor, which rebuilt inference requests and checked all other traffic against a whitelist ⁸. Amodo reports that all 800 test inferences were tapped and verified during a flood of about 1 Gbps of non-whitelisted traffic ⁸.
• SASH logger. SASH's public prototype passes every request through an inline software logger and re-runs it on a 270-million-parameter model; it computes no hashes of the traffic ⁹. See SASH confidential network logger.

Limitations

• Output steganography. The paper estimates about 40 Mbit/s of covert egress from output nondeterminism for a 200k-GPU cluster, even with replay checks ¹. An attacker who chooses the prompts roughly doubles per-token leakage under Gumbel-based verification ¹¹; see Deterministic and bit-exact inference and Bounding unexplained information in outputs.
• Line rate. On tested CPUs, no hash algorithm kept up with minimum-size frames, and the tested DPU was insufficient ⁷.
• Optics and copper. Passive taps are impractical on 400GBASE-SR8 multimode links, and copper-connected racks are much harder to tap ². For 53 and 106 GBaud links, Amodo says a new ASIC may be needed ⁶.
• Encryption. TEE-protected fabrics would hide plaintext from both parties ².
• Passive-tap side channels. Amodo concludes that its passive tap must become active ⁸.
• Bypass. Physical monitoring, and radio, power-line and thermal channels, are outside the network design ¹; see Tamper evidence for verifier devices and Side-channel suppression for isolated facilities.