Mechanism · TEE remote attestation for AI workloads
Deployment-level attestation does not cover the whole chip
On this page
SignificantTheoretical argumentOpenMechanism-level evidence
Evidence scope
A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request 11.
An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan" 11. This matters most for negative claims such as the absence of training.
Sources: [11]