Mechanism · Network taps and certifiers
Evidence & limits
On this page
R1Proposed for committing a complete record of cluster traffic, so declared inference can be checked
ReadinessMedium confidence
The Secure Gateway Device and related designs are public, but no tapped prototype has run at production link rates or with an active warden.
Assessed use: committing a complete record of cluster traffic, so declared inference can be checked
Rubric assessment
- R1 met: the Secure Gateway Device paper specifies the architecture, its goal (no covert exfiltration of results through tapped wires), its assumptions (physical monitoring, prover-held plaintext) and covert-channel estimates 1. Feasibility and cost analyses cover north-south, storage and compute-fabric taps 2. The MIRI overview places taps in a full reference architecture 3, and the AI 2040 plan relies on them 4.
- R2 not met: Amodo reports a passive fibre tap on a 1 Gbps lab link, with all 800 test inferences tapped and verified during a throughput stress test that flooded the link with non-whitelisted traffic 8. That result is provider-reported on a blog, at link rates far below production frontend links, with no hashing of traffic contents and no test against an adversary 8. Amodo says the passive tap must become active to close side channels 8. Amodo's code is public at tag v0.2.0 and includes the tap's frame processor 8 10. The most mature Implementation, SASH's confidential network logger, has public code, but it runs a toy model through an inline software proxy that computes no hashes 11 12. AI 2040 inference-only verification stack and Low-trust AI compute verification system overview are proposed architectures assessed R1. The Secure Gateway Device paper states that empirical validation and red-teaming are still required 1.
Confidence is medium: the Amodo test uses real passive tap hardware, but at 1 Gbps, as a stress test rather than against an adversary, and without the hashed record the designs rely on.
Gaps to the next level
- Hashing and tapping demonstrated at production frontend link rates (400 Gbps class), including minimum-size frames.
- A built active warden or Secure Gateway Device, with measured residual covert bandwidth.
- Red-teaming of tap bypass, covert channels and physical security.
Assessed 2026-09-25 against rubric v1.1.
Mechanism properties
| Threat model | Adversarial prover |
|---|---|
| Adversarial evaluation | Analysis |
| Hardware needed | Retrofit device |
| Prover cooperation | Required |
| Confidentiality | Partial |
Evidence
- Designs and analysis. The Secure Gateway Device paper, Cankaya's feasibility note and the MIRI overview are design studies 1 2 3. The paper states that empirical validation is still required and calls for red-teaming by specialists 1.
- Commercial precedent. Taps are used for stock-exchange monitoring, packet capture, defence networks and lawful intercept 3. The MIRI overview says AI use needs changes for a nation-state covert adversary 3.
- Amodo's first tap test (March 2026). A passive multimode splitter on a link of about 10 Gbps copied both directions of traffic to a monitoring machine 5.
- Amodo's tap survey (May 2026). Commodity taps exist for 26 GBaud links, but none are advertised for 53 GBaud 6.
- Amodo's hashing benchmarks (July 2026). On an AMD EPYC server CPU on a 400 Gbps link, all tested hash algorithms except BLAKE3 kept up with 1500-byte frames 7. None reached line rate with 64-byte frames within the CPU's physical core count, and the tested DPU fell short of the 400 Gbps target 7.
- Amodo's tapped prototype (September 2026). A passive fibre tap on a 1 Gbps lab link of its inference-verification prototype fed a frame processor, which rebuilt inference requests and checked all other traffic against a whitelist 8. Amodo reports that all 800 test inferences were tapped and verified during a stress test that flooded the link with about 1 Gbps of non-whitelisted traffic 8. The frame processor computes no hashes of the traffic contents 8. Its code is public at tag v0.2.0 10.
- Production boundary. The AI 2040 companion page reports passive optical tap components working at 400G 9. The published inference-verification tap test ran at 1 Gbps, without content hashes or an active warden 8. Neither result demonstrates a complete monitored facility perimeter.
- SASH logger. SASH's public prototype passes every request through an inline software logger and re-runs it on a 270-million-parameter model; it computes no hashes of the traffic 11. See SASH confidential network logger.
Limitations
- Output steganography. The paper estimates about 40 Mbit/s of covert egress from output nondeterminism for a 200k-GPU cluster, even with replay checks 1. An attacker who chooses the prompts roughly doubles per-token leakage under Gumbel-based verification 13; see Deterministic and bit-exact inference and Bounding unexplained information in outputs.
- Line rate. On the tested CPU, no hash algorithm kept up with minimum-size frames within its physical core count, and the tested DPU was insufficient 7.
- Optics and copper. Passive taps are impractical on 400GBASE-SR8 multimode links, and copper-connected racks are much harder to tap 2. For 53 and 106 GBaud links, Amodo says a new ASIC may be needed 6.
- Encryption. TEE-protected fabrics would hide plaintext from both parties 2.
- Passive-tap side channels. Amodo concludes that its passive tap must become active 8.
- Bypass. Physical monitoring, and radio, power-line and thermal channels, are outside the network design 1; see Tamper evidence for verifier devices and Side-channel suppression for isolated facilities.
Known flaws
Blockers
No complete verification tap has been demonstrated at production frontend link rates, and on the tested CPU no hash algorithm reached line rate with minimum-size frames.
Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove.
Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them.
Radio, power-line and thermal channels are not addressed by network-level designs.
Red-teaming by specialists is called for but has not been reported.