Only recorded traffic is checked

Recomputation checks that recorded, declared workloads are correct. It cannot show that the record is complete. The published schemes do not cover hidden workloads run on the same compute, or substituted work ³. Rinberg et al. say their exfiltration-detection scheme cannot stand alone ¹.