Attestation covers launch state, and measurements can be incomplete

Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately ¹⁰. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself" ¹¹. Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them ^{29 30}. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged ²⁶.